Rule: API Gateway Stage Cache Encryption at Rest Should Be Enabled

Rule Description

Troubleshooting Steps

2. 1.
   Identify the stages in your API Gateway deployment that have caching enabled.
4. 2.
   Check the current encryption settings for the cache in each of these stages.
6. 3.
   If encryption at rest is not enabled or configured correctly, follow the remediation steps provided below.

Remediation

API Gateway Console

2. 1.
   Open the API Gateway Console.
4. 2.
   Select the API Gateway instance and stage that you want to configure.
6. 3.
   In the left navigation pane, click on the "Caching" tab.
8. 4.
   Under the "Caching Settings" section, locate the option for "Encryption at Rest".
10. 5.
    Enable the encryption by ticking the checkbox or selecting the appropriate encryption method.
12. 6.
    Save the changes.

AWS CLI

2. 1.
   Open a command-line interface (CLI) tool.
4. 2.
   Run the following command to enable encryption at rest for the cache in API Gateway stages:

aws apigateway update-stage-cache --rest-api-id <rest_api_id> --stage-name <stage_name> --patch-operations op=replace,path=/caching/enableCacheEncryptionAtRest,value=true

Note: Replace

<rest_api_id>

with the unique identifier of your API Gateway instance, and

<stage_name>

with the name of the stage you want to configure.

2. 1.
   Verify that the encryption at rest has been enabled by checking the API Gateway stage settings.

Conclusion