Back to All Checks
High AppSync Regional

AWS AppSync GraphQL APIs should not be authenticated with API keys

NIST 800-53

Description

Flags AppSync GraphQL APIs that use API key authentication. API keys are hard-coded values that, if compromised, expose the endpoint to unauthorized access; stronger authentication methods should be used instead.

Remediation

Replace API key authentication with more secure authentication methods such as AWS IAM, Amazon Cognito User Pools, OpenID Connect, or AWS Lambda authorizers.

Steps

  1. Identify AppSync GraphQL APIs using API key authentication
  2. Choose an appropriate alternative authentication method (AWS IAM, Cognito, OpenID Connect, or Lambda)
  3. Update the API authentication configuration
  4. Update your application code to use the new authentication method
  5. Test the updated authentication flow
  6. Remove or disable the API key authentication

Compliance

NIST 800-53
Start Your Free Security Check