CODEWITHSUNDEEP
amazon-web-servicesaws-api-gatewayaws-cdk
夢のの夢
夢のの夢

Reputation: 5846

How to add security policy to API Gateway in CDK application?

I am trying to add a TLS to my API Gateway in my CDK app. But I am not sure where to add it to my API Gateway instance:

const api = new apiGateway.RestApi(this, "my-api", {..})
..

When I deploy this to AWS, I do see endpoints as

https://someid123.execute-api.us-east-1.amazonaws.com/prod

I am guessing this already has TLS enabled (with https)? if so, how do I view the actual security policy used?

Upvotes: 1

Views: 2719

Answers (2)

Balu Vyamajala
Balu Vyamajala

Reputation: 10383

REST Api supports TLS 1.2 and TLS 1.0 and When we add a custom domain, we can choose to pass Security policy. We can't choose for default endpoint provided by AWS.

securityPolicy: apigw.SecurityPolicy.TLS_1_2 to domainName.securityPolicy

const restapi = new apigw.RestApi(this, 'my-rest-api', {
    description: `test`,
    restApiName: `test-api`,
    endpointTypes: [apigw.EndpointType.REGIONAL],
    domainName: {
        securityPolicy: apigw.SecurityPolicy.TLS_1_2,
        domainName: `test-api.mydomain.com`,
        certificate: acm.Certificate.fromCertificateArn(
                      this,'my-cert', myCertArn),
        endpointType: apigw.EndpointType.REGIONAL,
    },
    deployOptions: {
        stageName: 'qa'
    },
});
    const hostedZone = route53.HostedZone.fromLookup(this, 'hosted-zone-lookup', {
        domainName: `mydomain.com`,
    });
    new route53.ARecord(this, 'api-gateway-route53', {
        recordName: `test-api.mydomain.com`,
        zone: hostedZone,
        target: route53.RecordTarget.fromAlias(new route53Targets.ApiGateway(restApi)),
    });

Upvotes: 3

Marcin
Marcin

Reputation: 238687

Why you deploy API Gateway, the url of the endpoint will have AWS provided SSL certificate.

The APIs created with Amazon API Gateway expose HTTPS endpoints only. API Gateway doesn't support unencrypted (HTTP) endpoints.

You have no control over its policies, and there is no AWS API to get its details. But, you can check it in the browser after connecting to the API endpoint, e.g. in Firefox:

enter image description here

If you want to control your own certificates, you need your own domain.

Upvotes: 1

Related Questions