Back to Checks
aws

AWS AppSync GraphQL API does not use API key authentication

appsync_graphql_api_no_api_key_authentication
Service: appsyncSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsAppSyncGraphQLApi

AWS AppSync GraphQL APIs are examined for the default authorization type. The finding indicates an API configured with API_KEY instead of IAM, Cognito, OIDC, or Lambda authorizers.

Prowler logoProwlerprowler-provider-aws

Risk

Static API keys can be leaked or reused, enabling unauthorized queries and mutations.

  • Confidentiality: unrestricted data reads
  • Integrity: unauthorized writes and schema misuse
  • Accountability: no user identity for auditing, difficult revocation and scoping

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks appsync_graphql_api_no_api_key_authentication

Recommendation

Replace API_KEY with stronger modes and apply least privilege:

  • AWS_IAM for service-to-service
  • Cognito User Pools or OIDC for end users
  • Lambda authorizer for custom logic If guest access is unavoidable, limit to read-only fields, enforce throttling, use short key lifetimes, and apply schema-level authorization.

Remediation

CLI

aws appsync update-graphql-api --api-id <api-id> --name <api-name> --authentication-type AWS_IAM

Terraform

# AppSync GraphQL API with non-API key auth
resource "aws_appsync_graphql_api" "<example_resource_name>" {
  name                = "<example_resource_name>"
  authentication_type = "AWS_IAM"  # Critical: avoids API_KEY default auth
}

NativeIaC

# CloudFormation: set default auth to non-API key
Resources:
  <example_resource_name>:
    Type: AWS::AppSync::GraphQLApi
    Properties:
      Name: <example_resource_name>
      AuthenticationType: AWS_IAM  # Critical: switches default auth away from API_KEY

Other

1In the AWS Console, go to AppSync > APIs and select your GraphQL API
2Open Settings (Authorization)
3Change Default authorization mode to AWS IAM (or Cognito/OIDC/Lambda)
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.appsync.appsync_client import appsync_client


class appsync_graphql_api_no_api_key_authentication(Check):
    def execute(self):
        findings = []
        for api in appsync_client.graphql_apis.values():
            if api.type == "GRAPHQL":
                report = Check_Report_AWS(metadata=self.metadata(), resource=api)
                report.status = "PASS"
                report.status_extended = f"AppSync GraphQL API {api.name} is not using an API KEY for authentication."
                if api.authentication_type == "API_KEY":
                    report.status = "FAIL"
                    report.status_extended = f"AppSync GraphQL API {api.name} is using an API KEY for authentication."
                findings.append(report)

        return findings

References