API Gateway REST API has no request validators configured
- Severity
- Medium
- Service
- API Gateway
- Check ID
- APIGW_NO_REQUEST_VALIDATION
What this check finds
This REST API has no request validators. Without validators, API Gateway passes all requests to the backend regardless of payload format, enabling injection and oversized request attacks.
Passing looks like: API Gateway request validation configured.
How to fix it
Create a request validator and attach it to methods.
AWS CLI
aws apigateway create-request-validator --rest-api-id API_ID --validate-request-body --validate-request-parameters
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
API Gateway → REST API → Models + Request Validators.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| PCI-DSS v4.0.1 |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More API Gateway checks
- HighAPI Gateway execute-api endpoint not disabled — CloudFront WAF bypassable
- HighAPI Gateway REST API method has no authorization
- HighHTTP API (v2) has no JWT authorizer configured
- HighPrivate API has no resource policy restricting access
- MediumAPI Gateway custom domain TLS minimum version below 1.2
- MediumAPI Gateway stage not associated with a WAF Web ACL
- LowAPI Gateway stage does not have access logging enabled
- LowAPI Gateway stage has no method-level throttling configured