Back to Checks
aws

API Gateway REST API stage has client certificate enabled

apigateway_restapi_client_certificate_enabled
Service: apigatewaySeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsApiGatewayStage

API Gateway stage has a client certificate configured so HTTP/S integrations can perform mutual TLS and authenticate API Gateway to the backend

Prowler logoProwlerprowler-provider-aws

Risk

Without client authentication to the backend, requests cannot be proven to originate from API Gateway. Direct calls to the backend may bypass gateway policies, enabling unauthorized access and data tampering. This degrades integrity and confidentiality and reduces auditability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks apigateway_restapi_client_certificate_enabled

Recommendation

Enable mutual TLS from API Gateway to the backend with a client certificate, and configure the backend to trust only that identity. Apply zero trust and least privilege: block public access to the backend, restrict networks, rotate certificates, and monitor authentication failures.

Remediation

CLI

aws apigateway update-stage --rest-api-id <REST_API_ID> --stage-name <STAGE_NAME> --patch-operations op=replace,path=/clientCertificateId,value=<CLIENT_CERT_ID>

Terraform

# Terraform: attach a client certificate to a REST API stage
resource "aws_api_gateway_client_certificate" "example" {}

resource "aws_api_gateway_stage" "<example_resource_name>" {
  stage_name          = "<example_resource_name>"
  rest_api_id         = "<example_resource_id>"
  deployment_id       = "<example_resource_id>"
  client_certificate_id = aws_api_gateway_client_certificate.example.id  # Critical: enables client certificate on the stage
}

NativeIaC

# CloudFormation: attach a client certificate to a REST API stage
Resources:
  ClientCert:
    Type: AWS::ApiGateway::ClientCertificate

  ApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      StageName: <example_resource_name>
      RestApiId: <example_resource_id>
      DeploymentId: <example_resource_id>
      ClientCertificateId: !Ref ClientCert  # Critical: enables client certificate on the stage

Other

1In the AWS Console, go to API Gateway > REST APIs and select your API
2In the left menu, click Client Certificates and create one (Generate)
3In the left menu, click Stages and select the target stage
4In Settings, find Client certificate and select the created certificate
5Click Save Changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.apigateway.apigateway_client import (
    apigateway_client,
)


class apigateway_restapi_client_certificate_enabled(Check):
    def execute(self):
        findings = []
        for rest_api in apigateway_client.rest_apis:
            for stage in rest_api.stages:
                report = Check_Report_AWS(metadata=self.metadata(), resource=stage)
                report.resource_id = rest_api.name
                report.region = rest_api.region
                if stage.client_certificate:
                    report.status = "PASS"
                    report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has client certificate enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} does not have client certificate enabled."
                findings.append(report)

        return findings

References