API Gateway stage not associated with a WAF Web ACL

Severity: Medium
Service: API Gateway
Check ID: WAF_NOT_ON_APIGW

What this check finds

This API Gateway REST API stage has no AWS WAF Web ACL attached. Without WAF, the API lacks protection against common web exploits and bot traffic.

Passing looks like: API Gateway associated with a WAF Web ACL.

How to fix it

Associate a WAF Web ACL with the API Gateway stage.

AWS CLI

aws wafv2 associate-web-acl --web-acl-arn WEB_ACL_ARN --resource-arn API_STAGE_ARN --scope REGIONAL

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

WAF → Web ACLs → select ACL → Associated AWS resources → Add.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to API Gateway stage not associated with a WAF Web ACL
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection SI-4 System Monitoring
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage DE.CM-01 Networks are monitored
ISO/IEC 27001:2022 Annex A	A.8.16 Monitoring activities A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More API Gateway checks

All API Gateway checks