Back to Checks
aws

API Gateway REST API has an authorizer at API level or all methods are authorized

apigateway_restapi_authorizers_enabled
Service: apigatewaySeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsApiGatewayRestApi

API Gateway REST APIs are evaluated for access control: an API-level authorizer is present, or all resource methods use an authorization mechanism. Methods marked NONE indicate unauthenticated access.

Prowler logoProwlerprowler-provider-aws

Risk

Unauthenticated API methods enable:

  • Arbitrary reads exposing data (confidentiality)
  • Unauthorized actions against backends (integrity)
  • Abuse and high traffic causing cost spikes or outages (availability)

Attackers can enumerate endpoints and invoke integrations without tokens.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks apigateway_restapi_authorizers_enabled

Recommendation

Require authentication on every method: use Cognito user pools, Lambda authorizers, or IAM; avoid NONE.

  • Enforce least privilege with scoped policies
  • Use private endpoints or resource policies for internal APIs
  • Add rate limiting and WAF for defense in depth

Remediation

Terraform

# Terraform: set method authorization so it's not public
resource "aws_api_gateway_method" "<example_resource_name>" {
  rest_api_id  = "<example_resource_id>"
  resource_id  = "<example_resource_id>"
  http_method  = "GET"
  authorization = "AWS_IAM" # Critical: authorizes the method (not NONE)
}

NativeIaC

# CloudFormation: set method authorization so it's not public
Resources:
  <example_resource_name>:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: <example_resource_id>
      ResourceId: <example_resource_id>
      HttpMethod: GET
      AuthorizationType: AWS_IAM  # Critical: authorizes the method (not NONE)

Other

1In the AWS Console, go to API Gateway > APIs (REST) and select your API
2Open Resources, select a resource, then select a method (e.g., GET)
3Click Method Request
4Set Authorization to AWS_IAM (or an existing Cognito/Lambda authorizer)
5Repeat for every method so none show Authorization = NONE
6Deploy the API to apply changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.apigateway.apigateway_client import (
    apigateway_client,
)


class apigateway_restapi_authorizers_enabled(Check):
    def execute(self):
        findings = []
        for rest_api in apigateway_client.rest_apis:
            report = Check_Report_AWS(metadata=self.metadata(), resource=rest_api)
            report.resource_id = rest_api.name

            # it there are not authorizers at api level and resources without methods (default case) ->
            report.status = "FAIL"
            report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} does not have an authorizer configured at api level."
            if rest_api.authorizer:
                report.status = "PASS"
                report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} has an authorizer configured at api level"
            else:
                # we want to know if api has not authorizers and all the resources don't have methods configured
                resources_have_methods = False
                all_methods_authorized = True
                resource_paths_with_unathorized_methods = []
                for resource in rest_api.resources:
                    # if the resource has methods test if they have all configured authorizer
                    if resource.resource_methods:
                        resources_have_methods = True
                        for (
                            http_method,
                            authorization_method,
                        ) in resource.resource_methods.items():
                            if authorization_method == "NONE":
                                all_methods_authorized = False
                                unauthorized_method = (
                                    f"{resource.path} -> {http_method}"
                                )
                                resource_paths_with_unathorized_methods.append(
                                    unauthorized_method
                                )
                # if there are methods in at least one resource and are all authorized
                if all_methods_authorized and resources_have_methods:
                    report.status = "PASS"
                    report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} has all methods authorized"
                # if there are methods in at least one result but some of then are not authorized-> list it
                elif not all_methods_authorized:
                    report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} does not have authorizers at api level and the following paths and methods are unauthorized: {'; '.join(resource_paths_with_unathorized_methods)}."

            findings.append(report)

        return findings

References