Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · APIGateway

APIGateway.5: REST API cache data should be encrypted at rest

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub APIGateway.5 check?

APIGateway.5 fails when a REST API method has caching enabled but its cached data is not encrypted at rest. The control evaluates per method, and only where caching is actually on.

Why does APIGateway.5 matter?

The API cache holds real response payloads (potentially containing sensitive data) sitting at rest in the cache cluster. Without the cacheDataEncrypted flag that data is unprotected. The fix is a single setting that costs nothing on top of the cache cluster you're already paying for.

How do I fix APIGateway.5?

  1. Find stages where cached methods have cacheDataEncrypted set to false.
  2. Set cacheDataEncrypted to true on the affected methods (or the stage-level default).
  3. Redeploy the stage so the change takes effect.
  4. Add an AWS Config rule and IaC defaults so the flag is always on for new caching.

Remediation script · bash

# 1. Bulk-enable free SSE-SQS on every unencrypted queue in the region.
for q in $(aws sqs list-queues --query 'QueueUrls[]' --output text); do
  state=$(aws sqs get-queue-attributes --queue-url $q \
    --attribute-names KmsMasterKeyId SqsManagedSseEnabled --query 'Attributes' --output text)
  [ -z "$state" ] && aws sqs set-queue-attributes --queue-url $q \
    --attributes '{"SqsManagedSseEnabled":"true"}' && echo "encrypted $q"
done

# 2. High-throughput stream: SSE-KMS with a 5-minute data-key reuse window to keep KMS cost flat.
aws kinesis start-stream-encryption --stream-name payment-events \
  --encryption-type KMS \
  --key-id arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

# 3. Find unencrypted recovery points (Backup.1 reads IsEncrypted per recovery point, not per vault).
aws backup list-recovery-points-by-backup-vault --backup-vault-name prod-backups \
  --query 'RecoveryPoints[?IsEncrypted==`false`].[RecoveryPointArn,ResourceType]' --output table

# 4. Confirm an at-rest Config rule is evaluating so regressions are caught automatically.
aws configservice describe-compliance-by-config-rule --config-rule-names sqs-queue-encrypted \
  --query 'ComplianceByConfigRules[].Compliance.ComplianceType'

Full walkthrough (console steps, edge cases and verification) in the lesson Encrypt other services at rest (queues, streams, logs, ML).

Is APIGateway.5 a false positive?

The encryption checkbox sits separately from the cache size and TTL settings, so the usual cause is someone enabling caching and saving without ticking it: the data isn't encrypted just because caching looks configured.

Full lesson Encrypt other services at rest (queues, streams, logs, ML) Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for APIGateway controls ↗ Check your own account for APIGateway.5 →
Part of the learning path Encrypt everything

More APIGateway controls