API Gateway V2 API has an authorizer configured

apigatewayv2_api_authorizers_enabled

Service: apigatewayv2Severity: medium

OfficialBuilt-inVerified

Categories:identity-access

Resource Type:AwsApiGatewayV2Api

API Gateway v2 APIs use authorizers (JWT/Cognito or Lambda) to authenticate requests. This evaluates whether an API has an authorizer configured to control access to its routes.

Prowler prowler-provider-aws

Risk

Without an authorizer, anyone can invoke routes.

Confidentiality: exposure of data and metadata
Integrity: unauthorized state changes or actions
Availability/Cost: automated abuse of backends, traffic spikes, and unexpected spend

Run this check with Prowler

Run in Prowler Cloud

Run

prowler aws --checks apigatewayv2_api_authorizers_enabled

Recommendation

Enable an authorizer (JWT/Cognito or Lambda) so only authenticated principals can invoke routes.

Enforce least privilege with scopes/claims or policy decisions
Apply defense in depth with resource policies, throttling, and WAF
Avoid public routes unless explicitly required

Remediation

CLI

aws apigatewayv2 create-authorizer --api-id <API_ID> --authorizer-type REQUEST --name <example_resource_name> --authorizer-uri arn:aws:apigateway:<REGION>:lambda:path/2015-03-31/functions/<LAMBDA_FUNCTION_ARN>/invocations --identity-source '$request.header.Authorization'

Terraform

# Minimal AWS API Gateway v2 Lambda authorizer
resource "aws_apigatewayv2_authorizer" "<example_resource_name>" {
  api_id           = "<example_resource_id>"
  name             = "<example_resource_name>"
  authorizer_type  = "REQUEST"  # Critical: creates a Lambda REQUEST authorizer
  authorizer_uri   = "arn:aws:apigateway:<REGION>:lambda:path/2015-03-31/functions/<LAMBDA_FUNCTION_ARN>/invocations"  # Critical: Lambda to invoke
  identity_sources = ["$request.header.Authorization"]  # Critical: identity source for authorization
}

NativeIaC

# CloudFormation: create a minimal Lambda authorizer for API Gateway v2
Resources:
  <example_resource_name>:
    Type: AWS::ApiGatewayV2::Authorizer
    Properties:
      ApiId: <example_resource_id>
      AuthorizerType: REQUEST  # Critical: enables a Lambda REQUEST authorizer on the API
      AuthorizerUri: arn:aws:apigateway:<REGION>:lambda:path/2015-03-31/functions/<LAMBDA_FUNCTION_ARN>/invocations  # Critical: Lambda authorizer function to invoke
      IdentitySource:  # Critical: where to read the auth token from
        - "$request.header.Authorization"
      Name: <example_resource_name>

Other

1In the AWS Console, go to API Gateway > APIs and select your HTTP/WebSocket API

2In the left nav, click Authorizers > Create authorizer

3Choose Lambda as the authorizer type and select your Lambda function

4Set Identity source to: $request.header.Authorization

5Click Create to add the authorizer

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.apigatewayv2.apigatewayv2_client import (
    apigatewayv2_client,
)


class apigatewayv2_api_authorizers_enabled(Check):
    def execute(self):
        findings = []
        for api in apigatewayv2_client.apis:
            report = Check_Report_AWS(metadata=self.metadata(), resource=api)
            report.resource_id = api.name
            report.status = "FAIL"
            report.status_extended = f"API Gateway V2 {api.name} ID {api.id} does not have an authorizer configured."
            if api.authorizer:
                report.status = "PASS"
                report.status_extended = f"API Gateway V2 {api.name} ID {api.id} has an authorizer configured."
            findings.append(report)

        return findings