Description

Detects when an AWS API Gateway method is configured to accept ALL HTTP methods through the 'ANY' method setting. This creates overly permissive API endpoints that could allow attackers to use unexpected HTTP methods, potentially bypassing security controls or accessing unintended functionality.

Detection Strategy

• Examines AWS API Gateway method resources in Terraform configuration files

• Identifies method configurations where 'http_method' is set to 'ANY'

• Reports a vulnerability when an API Gateway method allows all HTTP methods instead of explicitly limiting to required methods

Vulnerable code example

resource "aws_api_gateway_method" "vulnerable_example" {
  rest_api_id = aws_api_gateway_rest_api.example.id
  resource_id = aws_api_gateway_resource.example.id
  http_method = "ANY"  # VULNERABLE: Using "ANY" allows all HTTP methods, increasing attack surface
}

✅ Secure code example

resource "aws_api_gateway_method" "secure_example" {
  rest_api_id = aws_api_gateway_rest_api.example.id
  resource_id = aws_api_gateway_resource.example.id
  http_method = "GET"  # Only allow specific HTTP methods needed for functionality
  authorization = "AWS_IAM"  # Enable IAM authorization for access control
}