All checks
High
AWS AppSync GraphQL APIs should not be authenticated with API keys
Flags AppSync GraphQL APIs whose default authorization mode is API key. A key is a hard-coded value that, if compromised, exposes the endpoint to unauthorized access. Only the default mode is read: an API key kept as an additional authorization mode still works on the fields it covers and still passes.
- service
- AppSync
- severity
- High
- scope
- evaluated in every region
How to fix it
- Can break clients: Clients that send only an x-api-key header are refused once API key is no longer a mode, so move each one to the new mode first.
In the console
AppSync → APIs → the API → Settings
- Additional authorization modes
- Add the new mode first, so clients can move to it one at a time
- Default authorization mode
- AWS IAM, Amazon Cognito user pool, OpenID Connect or AWS Lambda
- API keys
- Delete each key, and remove API key from the additional modes, once no client uses them
With Terraform
resource "aws_appsync_graphql_api" "this" {
name = var.api_name
authentication_type = "AWS_IAM"
}See which of your accounts this check is failing on.
Book a live scan