Quickly Auditing Unauthenticated Public Exposure of API Gateway Resources for AWS WAF Implementation

As a developer, I've often found myself in situations where I need to quickly identify public exposed resources that are not protected by a robust authorization mechanism. Recently, my colleague and I were tasked with conducting an inventory of our public exposed resources that were not shielded by authentication methods handled by AWS API Gateway (such as IAM or API keys).

Our initial goal was to gain a better understanding of our public-facing resources, but what we discovered was startling. A staggering 7% of our API Gateways were inadvertently exposing us to risk and should never have been made publicly accessible in the first place.

This discovery led me to prioritize my focus on identifying specific API Gateway endpoints that required immediate attention for our AWS WAF rollout. The goal was to minimize the risk of direct external threats or attacks against our organization.

If you've ever found yourself facing a similar challenge, I'm sure you can appreciate the importance of quickly auditing unauthenticated and public exposure of your API Gateway resources before implementing AWS WAF. By doing so, you'll be better equipped to identify potential vulnerabilities and take proactive measures to protect your company's assets.

In this article, we'll explore some strategies for quickly identifying unauthenticated public exposure of API Gateway resources, as well as the benefits of implementing AWS WAF for enhanced security and protection.

Aws waf api gateway