Make sure to change the profile (three times in the one liner) and add -region if you need to use another one then your default configured. So I started to write a one-liner in bash using aws cli v2 (tested on Ubuntu 20.04 & macos big sur) to do that for me. I quickly decided that we would not spend time on doing an inventory on what authorization each resource is configured with in all the 312 API Gateway endpoints in production. It started with my colleague and I needing to do an inventory, We needed to understand our public exposed resources that were not protected by a authorization mechanism that is handled by AWS API Gateway (IAM, API keys etc). AWS WAF works as a first line of defence for AWS CloudFront, Application Load Balancer or Amazon API Gateway. Well, I actually changed my prioritization as we found that 7% of our API Gateways were not supposed to be public and were exposing us for to risk. I had and I needed it to understand what API Gateway endpoints I would like to focus on for our AWS WAF rollout to minimize the risk of direct external threat / attack for the company I work for. API gateways work at the network level but, more specifically, they handle incoming traffic requests specifically seeking the API.

Have you ever had the need to quickly audit your unauthenticated & public exposure of your API Gateway resources to plan a implementation of AWS WAF (Web Application Firewall)? The solution includes two parts: Prerequisites (mostly the left part of the scheme) - AWS ALB, Compute Resources (EC2, EKS, etc.). API gateways are designed to handle authentication and authorization of requests to access an API.

Aws waf api gateway