Back to Checks
aws

API Gateway REST API stage cache data is encrypted at rest

apigateway_restapi_cache_encrypted
Service: apigatewaySeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsApiGatewayStage

API Gateway REST API stages with caching have cache data encrypted at rest. The evaluation targets stages where caching is enabled and verifies that stored responses are protected via the Encrypt cache data setting.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted cache contents can expose response payloads, tokens, or PII if cache storage, backups, or admin tooling are accessed outside normal controls, harming confidentiality and enabling replay or session hijacking.

Disclosure also reveals API patterns, aiding lateral movement and targeted abuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks apigateway_restapi_cache_encrypted

Recommendation

  • Enable encryption at rest for any cached stage (Encrypt cache data).
  • Apply least privilege to stage administration and cache invalidation.
  • Avoid caching sensitive endpoints; use short TTLs and scheduled cache flushes for defense in depth.

Remediation

CLI

aws apigateway update-stage --rest-api-id <restapi-id> --stage-name <stage-name> --patch-operations op=replace,path=/*/*/caching/dataEncrypted,value=true

Terraform

# Enable encryption for all cached methods in the stage
resource "aws_api_gateway_stage" "<example_resource_name>" {
  rest_api_id   = "<example_resource_id>"
  stage_name    = "<example_resource_name>"
  deployment_id = "<example_resource_id>"

  method_settings {
    resource_path        = "/*"
    http_method          = "*"
    cache_data_encrypted = true  # Critical: encrypt cached responses at rest
  }
}

NativeIaC

# CloudFormation: enable encryption for all cached methods in a stage
Resources:
  <example_resource_name>:
    Type: AWS::ApiGateway::Stage
    Properties:
      StageName: <example_resource_name>
      RestApiId: <example_resource_id>
      DeploymentId: <example_resource_id>
      MethodSettings:
        - ResourcePath: /*
          HttpMethod: "*"
          CacheDataEncrypted: true  # Critical: encrypt cached responses at rest for all methods

Other

1Open the AWS Console and go to API Gateway
2Select your REST API, then click Stages and choose the affected stage
3In Method overrides (or Cache settings), enable Encrypt cache data
4Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.apigateway.apigateway_client import (
    apigateway_client,
)


class apigateway_restapi_cache_encrypted(Check):
    def execute(self):
        findings = []
        for rest_api in apigateway_client.rest_apis:
            for stage in rest_api.stages:
                if stage.cache_enabled:
                    report = Check_Report_AWS(metadata=self.metadata(), resource=stage)
                    report.region = rest_api.region
                    report.resource_id = rest_api.name
                    report.status = "PASS"
                    report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has cache encryption enabled."
                    if not stage.cache_data_encrypted:
                        report.status = "FAIL"
                        report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has cache enabled but cache data is not encrypted at rest."
                    findings.append(report)

        return findings

References