<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-cloud-api-gateway-security
description: >-
  Audit cloud API gateway configurations for authentication bypass,
  rate limiting gaps, excessive data exposure, injection flaws, and
  misconfigured CORS policies across AWS API Gateway, GCP Apigee,
  and Azure API Management.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - api-gateway
  - authentication
  - rate-limiting
  - cors
  - waf
  - owasp-api
  - authorization
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Auditing Cloud API Gateway Security

## Overview

Audit cloud API gateway configurations for authentication bypass, rate limiting gaps, excessive data exposure, injection flaws, and misconfigured CORS policies across AWS API Gateway, GCP Apigee, and Azure API Management.

Mode: `[MODE: BLUE]` — Audit gateway security. `[MODE: RED]` — Test gateway bypass (T1190).

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI, gcloud CLI, or az CLI configured | Required |
| API Gateway admin access | Required |
| API inventory documented | Required |

## Key Concepts

### AWS API Gateway Audit

```bash
# List REST APIs
aws apigateway get-rest-apis --output json | \
  jq '.items[] | {{id: .id, name: .name}}'

# Check authentication on methods
aws apigateway get-resources --rest-api-id API_ID --output json | \
  jq '.items[].resourceMethods | to_entries[] |
  select(.value.authorizationType == "NONE") | .key'

# Check for WAF association
aws wafv2 list-web-acls --scope REGIONAL --output json

# Audit API stages
aws apigateway get-stages --rest-api-id API_ID --output json | \
  jq '.item[] | {{stage: .stageName, throttle: .methodSettings["*/*"].throttlingRateLimit}}'
```

### Rate Limiting Configuration

```bash
# Check usage plans
aws apigateway get-usage-plans --output json | \
  jq '.items[] | {{name: .name, throttle: .throttle, quota: .quota}}'
```

### CORS Policy Audit

```bash
# Find wildcard CORS origins
aws apigateway get-rest-api --rest-api-id API_ID | \
  grep -i "access-control-allow-origin.*\*"
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production
cat /tmp/auditing-cloud-api-gateway-security-audit.json | jq '.findings[]'
```

## Detection

```yaml
title: Auditing Cloud Api Gateway Security Detection
id: 146b2183-b510-4603-b849-2bfc4070e0bd
status: experimental
description: Detects suspicious activity related to auditing cloud api gateway security techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Cloud Api Gateway Security Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] All API methods require authentication (no NONE)
- [ ] Rate limiting and throttling configured per method
- [ ] WAF attached to API Gateway stage
- [ ] CORS restricted to specific origins (no wildcard)
- [ ] Logging enabled on all stages
- [ ] Request validation enabled for body and parameters

## References

- [AWS API Gateway Security](https://docs.aws.amazon.com/apigateway/latest/developerguide/security.html)
- [OWASP API Security Top 10](https://owasp.org/API-Security/)
- [GCP API Gateway Security](https://cloud.google.com/api-gateway/docs/security)
- [MITRE ATT&CK T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
