steampipe plugin install awssteampipe plugin install aws

Table: aws_api_gateway_rest_api

REST API in API Gateway is a collection of resources and methods that are integrated with backend HTTP endpoints, lambda functions, or other AWS services. API Gateway REST APIs use a request/response model where a client sends a request to a service and the service responds back synchronously.

Examples

API gateway rest API basic info

select
  name,
  api_id,
  api_key_source,
  minimum_compression_size,
  binary_media_types
from
  aws_api_gateway_rest_api;

List all the rest APIs that have content encoding disabled

select
  name,
  api_id,
  api_key_source,
  minimum_compression_size
from
  aws_api_gateway_rest_api
where
  minimum_compression_size is null;

List all the APIs which are not configured to private endpoint

select
  name,
  api_id,
  api_key_source,
  endpoint_configuration_types,
  endpoint_configuration_vpc_endpoint_ids
from
  aws_api_gateway_rest_api
where
  not endpoint_configuration_types ? 'PRIVATE';

List of APIs policy statements that grant external access

select
  name,
  p as principal,
  a as action,
  s ->> 'Effect' as effect,
  s -> 'Condition' as conditions
from
  aws_api_gateway_rest_api,
  jsonb_array_elements(policy_std -> 'Statement') as s,
  jsonb_array_elements_text(s -> 'Principal' -> 'AWS') as p,
  string_to_array(p, ':') as pa,
  jsonb_array_elements_text(s -> 'Action') as a
where
  s ->> 'Effect' = 'Allow'
  and (
    pa [ 5 ] != account_id
    or p = '*'
  );

API policy statements that grant anonymous access

select
  title,
  p as principal,
  a as action,
  s ->> 'Effect' as effect,
  s -> 'Condition' as conditions
from
  aws_api_gateway_rest_api,
  jsonb_array_elements(policy_std -> 'Statement') as s,
  jsonb_array_elements_text(s -> 'Principal' -> 'AWS') as p,
  jsonb_array_elements_text(s -> 'Action') as a
where
  p = '*'
  and s ->> 'Effect' = 'Allow';

Control examples

.inspect aws_api_gateway_rest_api

AWS API Gateway Rest API

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
api_id	text	The API's identifier. This identifier is unique across all of APIs in API Gateway
api_key_source	text	The source of the API key for metering requests according to a usage plan
binary_media_types	jsonb	The list of binary media types supported by the RestApi. By default, the RestApi supports only UTF-8-encoded text payloads
created_date	timestamp with time zone	The timestamp when the API was created
description	text	The API's description
endpoint_configuration_types	jsonb	The endpoint configuration of this RestApi showing the endpoint types of the API
endpoint_configuration_vpc_endpoint_ids	jsonb	The endpoint configuration of this RestApi showing the endpoint types of the API
minimum_compression_size	bigint	A nullable integer that is used to enable compression (with non-negative between 0 and 10485760 (10M) bytes, inclusive) or disable compression (with a null value) on an API. When compression is enabled, compression or decompression is not applied on the payload if the payload size is smaller than this value
name	text	The API's name
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
policy	jsonb	A stringified JSON policy document that applies to this RestApi regardless of the caller and Method configuration
policy_std	jsonb	Contains the policy in a canonical form for easier searching.
region	text	The AWS Region in which the resource is located.
tags	jsonb	A map of tags for the resource.
title	text	Title of the resource.
version	text	A version identifier for the API
warnings	jsonb	The warning messages reported when failonwarnings is turned on during API import

turbot/aws