Giters

nccgroup / ScoutSuite

Multi-Cloud Security Auditing Tool

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Feature request: check that API Gateway Default Endpoints are disabled.

rdegraaf opened this issue · comments

commented

Is your feature request related to a problem? Please describe.

By default, every AWS API Gateway REST API has a "default endpoint" with a DNS name such as https://ab12cd34ef.execute-api.us-east-1.amazonaws.com. Default endpoints use a legacy TLS termination policy that supports TLS 1.0 and 1.1. A default endpoint is a fully functional API endpoint but its DNS name and TLS termination policy are not configurable. To assign a service-specific DNS name or TLS policy, one must create a "Custom Domain" within API Gateway and direct all callers to that endpoint name; the default endpoint is then superfluous.

Describe the solution you'd like

ScoutSuite should check that all API Gateways have Custom Domains and that their Default Endpoints are disabled. If this is deemed to be too strong of a condition, then every API Gateway that has a Custom Domain should also have its Default Endpoint disabled.