Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · APIGateway

APIGateway.2: REST stages should use SSL certs for backend auth

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub APIGateway.2 check?

APIGateway.2 fails when a REST API stage doesn't have a client SSL certificate configured for backend authentication. The certificate lets the backend verify that requests genuinely came from API Gateway.

Why does APIGateway.2 matter?

A public API can have Cognito auth, WAF, and throttling and still be bypassed if the backend origin is directly reachable: a tester who finds the ALB's DNS name can curl it and walk straight past every gateway control. The client certificate gives the backend a way to reject anything that didn't traverse the gateway, turning that direct curl into a TLS handshake error.

How do I fix APIGateway.2?

  1. Generate a client certificate with generate-client-certificate.
  2. Attach it to each stage by setting clientCertificateId via update-stage.
  3. Configure the backend (origin server or load balancer) to require and verify that certificate.
  4. Track certificate expiry so rotation doesn't silently break the path.

Remediation script · bash

# Raise the search-domain TLS policy and keep HTTPS enforced (no downtime, no re-index).
aws opensearch update-domain-config \
  --domain-name logs-prod \
  --domain-endpoint-options '{"EnforceHTTPS":true,"TLSSecurityPolicy":"Policy-Min-TLS-1-2-PFS-2023-10"}'

# Pin an API Gateway custom domain to a recommended (enhanced 2025) TLS security policy.
# Enhanced policies require endpointAccessMode=STRICT, set in the same call.
aws apigateway update-domain-name \
  --domain-name api.example.com \
  --patch-operations '[{"op":"replace","path":"/securityPolicy","value":"SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09"},{"op":"replace","path":"/endpointAccessMode","value":"STRICT"}]'

# Confirm the live policy once the domain settles.
aws opensearch describe-domain-config --domain-name logs-prod \
  --query 'DomainConfig.DomainEndpointOptions.Options.TLSSecurityPolicy' \
  --output text

Full walkthrough (console steps, edge cases and verification) in the lesson Enforce TLS on APIs and search domains.

Is APIGateway.2 a false positive?

A client SSL certificate only does anything when the stage proxies to an HTTP origin the certificate can authenticate to. The underlying Config rule (api-gw-ssl-enabled) actually returns NOT_APPLICABLE when the integration type isn't HTTP, so a stage that fronts only Lambda proxy, mock, or AWS service integrations has no origin to present a certificate to and the check correctly drops out. The case to watch is a mixed API where one method uses an HTTP integration: the stage then fails, but if that path runs entirely over VPC Link to a private backend you already trust, the certificate buys you nothing. Document that integration topology and suppress the finding rather than attaching a certificate the backend will never verify.

Full lesson Enforce TLS on APIs and search domains Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for APIGateway controls ↗ Check your own account for APIGateway.2 →
Part of the learning path Encrypt everything

More APIGateway controls