A collection of configuration templates for AWS ApiGateway as well as security controls for monitoring and protecting AWS ApiGateway configuration such as Config Rules, CloudWatch Alarms, EventBridge Rules, IAM policies, and more.

API Gateway
API Gateway Stage

This template creates a stage for the `TestDeployment` deployment. The stage specifies the stage name as `Prod` and the description as `Prod Stage`. It also references the `MyRestApi` API, `TestDeployment` deployment, `MyDocumentationVersion` documentation version, and `ClientCertificate` client certificate. The stage includes variables with the value `Prod` for the `Stack` variable. Additionally, it defines method settings for different resource paths and HTTP methods, enabling metrics and disabling data trace. The `/stack` resource path with the `POST` HTTP method has a throttling burst limit of `999`, while the `/stack` resource path with the `GET` HTTP method has a throttling burst limit of `555`.

CloudFormation
API Gateway VPC Link to Load Balancer

This template creates an API Gateway VPC link for a REST API to access resources in an Amazon Virtual Private Cloud (VPC). It creates an API Gateway VPC link with the specified description and name. The VPC link is associated with a load balancer and a subnet in the VPC.

CloudFormation
API Key Association with Usage Plan

This template creates an `AWS::ApiGateway::UsagePlanKey` resource that associates a new API key with a usage plan (usageplan-1234567).

CloudFormation
API Gateway Usage Plan

This template creates a usage plan for the Prod API stage, with a quota of 5000 requests per month and a rate limit of 100 requests per second. It includes the properties for the API stages, description, quota, throttle, and usage plan name.

CloudFormation
Regional API Gateway Rest Api with OpenAPI Swagger Specification

This template imports an API Gateway RestApi resource with an endpoint type of REGIONAL. The RestApi resource is named 'RestApi' and includes a Swagger OpenAPI specification in the 'Body' property. The endpoint type is set to REGIONAL and the RestApi has a name of 'myApi'.

CloudFormation
Basic Regional API Gateway

This template creates an API Gateway RestApi resource with an endpoint type. The template includes parameters for 'apiName' and 'type'. The RestApi resource is named 'MyRestApi' and the endpoint type is set to the value of the 'type' parameter.

CloudFormation
Basic API Gateway Resource

This template creates a resource in an API. It creates a `stack` resource for the `MyApi` API. The `RestApiId` property is set to the `RestApi` reference. The `ParentId` property is set to the `RootResourceId` of the `RestApi` resource. The `PathPart` property is set to `stack`.

CloudFormation
API Gateway Model

This template creates an `AWS::ApiGateway::Model` resource that defines the structure of a request or response payload for an API method. The model is created with the specified properties, such as the REST API ID, content type, description, name, and schema. The schema is defined using JSON Schema and specifies the structure of the payload.

CloudFormation
API Gateway with Basic Request Validation

This template creates a REST API, method, and request validator, and associates the request validator with the method.

CloudFormation
API Gateway with Lambda Proxy Integration

This template creates a proxy resource to enable clients to call a Lambda function with a single integration setup on a catch-all ANY method. It sets the `RestApiId` property to the `LambdaSimpleProxy` reference, the `ResourceId` property to the `ProxyResource` reference, the `HttpMethod` property to `ANY`, the `AuthorizationType` property to `NONE`, and the `Integration` property to `AWS_PROXY` with the `IntegrationHttpMethod` property set to `POST` and the `Uri` property set to the ARN of the `LambdaForSimpleProxy` function.

CloudFormation
API Gateway Mock Method

This template creates a mock GET method for the `MyApi` API. It sets the `RestApiId` property to the `MyApi` reference, the `ResourceId` property to the `MyApi`'s root resource ID, the `HttpMethod` property to `GET`, the `AuthorizationType` property to `NONE`, and the `Integration` property to `MOCK`.

CloudFormation
Configure Custom API Gateway Response (404 Error)

This template creates a gateway response for a 404 status code. It sets the response parameters for Access-Control-Allow-Origin and Access-Control-Allow-Headers, and associates it with a specific REST API.

CloudFormation
API Gateway with Custom Domain

This template creates a custom domain name of `example.mydomain.com` for an API in API Gateway. It uses parameters to specify the domain name, base path, and REST API name. It also creates a certificate, a base path mapping, and a REST API resource.

CloudFormation
API Gateway Documentation Part with Documentation Version

This template creates a documentation part for an API entity and associates it with a documentation version. It creates a `RestApi` resource with the specified name. Then it creates a `DocumentationPart` resource with the specified location, `RestApiId`, and `Properties`. Finally, it creates a `DocumentationVersion` resource with the specified description, documentation version, and `RestApiId`.

CloudFormation
API Gateway Deployment Stage

This template creates an API Gateway deployment for the `my-rest-api` API. It deploys the API to a stage named `DummyStage`. The deployment is described as `My deployment`.

CloudFormation
Example API Gateway Client Certificate

This template creates a client certificate that can be used with an API Gateway deployment and stage. The client certificate is created with a description of 'A test client certificate'.

CloudFormation
API Gateway Custom Authorizer

This template creates a custom authorizer for AWS API Gateway. The authorizer is an AWS Lambda function that is activated for methods with authorization enabled. The template sets the properties for the authorizer, including the authorizer credentials, result TTL in seconds, authorizer URI, type, identity source, name, and REST API ID.

CloudFormation
API Key for Rest API Gateway Stage

This template creates an API key and associates it with the Test stage of the TestAPIDeployment deployment. The API key is named TestApiKey and has a description of CloudFormation API Key V1. It is enabled and associated with the RestApi and Stage resources specified in the template.

CloudFormation
IAM Role for API Gateway to CloudWatch Logs Configuration

This template creates an IAM role that API Gateway can assume to push logs to CloudWatch Logs. The example associates the role with the `AWS::ApiGateway::Account resource`.

CloudFormation
Config Rule
API Gateway Endpoint Type Check

A config rule that checks that Amazon API Gateway APIs are of type as specified (Allowed values are REGIONAL, PRIVATE and EDGE)

CloudFormationTerraformAWS CLI
API Gateway Execution Logging Enabled

A config rule that checks that methods in an Amazon API Gateway stage for deployed APIs have 'loggingLevel' as one of the values specified in the rule parameter 'loggingLevel'.

CloudFormationTerraformAWS CLI
API Gateway Not Edge Optimized

A config rule that checks that all APIs are private or regional, and not edge optimised.

CloudFormationTerraformAWS CLI
API Gateway Restricted to Private VPCs

A config rule that checks that all private APIs uses resource policy restricting to VPC endpoints or VPC in the same AWS account.

CloudFormationTerraformAWS CLI
API Gateway Restricted to Source IPs

A config rule that checks that non-private API GW have a resource based policy which limit their usage based on IP source

CloudFormationTerraformAWS CLI
API Gateway SSL Enabled

A Config rule that checks if a REST API stage uses an Secure Sockets Layer (SSL) certificate. This rule is NON_COMPLIANT if the REST API stage does not have an associated SSL certificate.

CloudFormationTerraformAWS CLI
API Gateway X-Ray Tracing Enabled

A Config rule that checks if X-Ray tracing is enabled on Amazon API Gateway REST APIs. The rule will return COMPLIANT if X-Ray tracing is enabled, NON_COMPLIANT otherwise.

CloudFormationTerraformAWS CLI
API Gateway Cache Enabled and Encrypted Check

A config rule that checks that Amazon API Gateway APIs are of type as specified (Allowed values are REGIONAL, PRIVATE and EDGE)

CloudFormationTerraformAWS CLI
Check if API Gateway V2 stages have access logging enabled

Checks if Amazon API Gateway V2 stages have access logging enabled. The rule is NON_COMPLIANT if 'accessLogSettings' is not present in Stage configuration.

CloudFormation
Check API Gatewayv2 API routes authorization type

Checks if Amazon API Gatewayv2 API routes have an authorization type set. This rule is NON_COMPLIANT if the authorization type is NONE.

CloudFormation
Check if API Gateway is associated with WAF

Checks if an Amazon API Gateway API stage is using an AWS WAF web access control list (web ACL). The rule is NON_COMPLIANT if an AWS WAF Web ACL is not used or if a used AWS Web ACL does not match what is listed in the rule parameter.

CloudFormation