Amazon API Gateway Security Review
API Gateway checks access route by route, and nothing keeps every route configured the same way. We test every route, authoriser, resource policy and stage for what it lets through. CREST-certified testers, fixed price from £3,350 for a 3-day single-estate scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
AWS’s own API reference lists NONE as a valid authorizationType for open access, alongside AWS_IAM, a Lambda authoriser or a Cognito user pool, and a route left on it deploys and works exactly like any other.
Why API Gateway risk sits in route configuration, not the service
Amazon API Gateway’s own Method API reference lists NONE as a valid authorizationType, described in AWS’s own words as for open access, alongside AWS_IAM, CUSTOM for a Lambda authoriser, and COGNITO_USER_POOLS. Because the setting is per method, one route added later, or migrated from a prototype, can sit on NONE while every route around it is protected, and the API deploys and serves traffic exactly the same either way.
A Lambda authoriser returns an IAM policy that API Gateway can cache to cut down on invocations, and AWS’s guidance is to make sure that policy is applicable to every resource and method it might be reused against, not only the one that triggered it. That decision sits above a separate layer again: a resource policy controlling which AWS account, source IP range or VPC endpoint can reach the API at all, evaluated independently of which authoriser protects each method, and, where the integration behind it is a Lambda function, independently again of what that function’s own execution role allows.
AWS WAF, where it is attached to a REST API stage, is evaluated before every other access control layer: if a WAF rule blocks a source your resource policy would otherwise allow, WAF takes precedence and the resource policy is never reached. None of that protects a backend that assumes a request already passed those checks. A private integration forwards traffic to a load balancer or VPC endpoint with no record that an authoriser ran, and the default execute-api endpoint AWS generates for every API stays reachable, on the same routes and the same authorisers, until you disable it and redeploy. We test the whole chain together, not each control in isolation, against the same AWS access control documentation your team built against.
SCOPE
What we review in your API Gateway setup
Authorisation Type on Every Route
Every method in API Gateway carries its own authorizationType, and AWS’s documentation lists NONE for open access as just as valid a value as AWS_IAM, a Lambda authoriser or a Cognito user pool. We map every route and method in scope against its configured type and flag any that are open, inconsistent with the routes around them, or protected by the wrong kind of authoriser for what the route does.
Lambda Authoriser Caching and Policy Scope
A Lambda authoriser returns an IAM policy that API Gateway can cache so the function is not invoked on every call, and AWS’s guidance is to make that policy applicable to every resource and method it might be reused against, not only the one that triggered it. We test what a cached policy actually authorises once traffic moves to a different route, and whether a TOKEN or REQUEST authoriser’s cache key can be forced to serve someone else’s decision.
Cognito and JWT Authorisers: Issuer, Audience and Scope
A Cognito user pool authoriser accepts a signed-in user’s identity or access token, and a JWT authoriser on an HTTP API separately checks that token’s issuer and audience against what you configured, plus any scopes you required on the route. Neither can tell an access token from an identity token on its own, so a route left without a required scope will accept whichever token type reaches it. We test the issuer, audience and scope rules configured on every protected route.
Resource Policies: Account, IP and VPC Conditions
A resource policy is a JSON document attached to the API itself, controlling which AWS account, source IP range or VPC endpoint can invoke it at all, independent of which authoriser protects each method. Resource policies exist on REST APIs only, with no equivalent on an HTTP API. We test what your resource policy actually allows against what the authorisers behind it assume has already been filtered out.
Private APIs and Interface VPC Endpoints
A private API is reachable only through an interface VPC endpoint inside your VPC, and that access still has to be restricted with a source VPC or VPC endpoint condition on the API’s resource policy, or a policy on the endpoint itself, or anything with network reach inside the VPC can call it. Private APIs are a REST-only feature. We test whether your endpoint and resource policy actually match the callers you intended.
Default execute-api Endpoint and Old Stages
API Gateway generates a default execute-api endpoint for every API, and it stays reachable, alongside any custom domain, until you explicitly disable it and redeploy every stage for the change to take effect. We check whether that default endpoint, and any stage your team has stopped actively using, is still live, and whether it still enforces the same authorisers and resource policy as the domain your clients actually use.
API Keys and Usage Plans Are Not Access Control
AWS’s own guidance says not to use API keys for authentication or authorisation: a key only tracks and throttles usage under a plan, and a key valid for one API in a usage plan can call every other API in that same plan. Usage plans and API keys exist on REST APIs only. We test whether a route is actually protected by an authoriser, or protected by nothing more than a key a customer was given.
Backend Trust: Lambda, HTTP and VPC Link Integrations
A Lambda proxy integration hands your function the full request, including whatever the authoriser wrote into its context, while an HTTP or VPC link integration simply forwards traffic to a load balancer or private endpoint that has no way of knowing an authoriser ran at all. We test whether the backend behind each integration re-checks that context, or trusts that anything reaching it must already be authorised.
Mutual TLS and WAF on the Custom Domain
Mutual TLS needs a custom domain, an ACM certificate and a truststore you upload to S3, and it only protects requests to that domain, not the default execute-api endpoint sitting alongside it. AWS WAF, available on REST API stages, is evaluated before every other access control layer, so a WAF rule that blocks a source your resource policy allows still wins. We test whether both are actually attached to every route that needs them.
Stage Logging and Sensitive Data Exposure
Standard execution logging redacts Authorization header values and API keys automatically, but turning on full request and response data tracing logs complete payloads, and AWS recommends against using it on production stages because those payloads can carry personal data or credentials your redaction rules never touch. We check what each stage actually logs against what your data protection obligations allow.
OUR PROCESS
Amazon API Gateway Security Review: From Scope to Attestation
Scope and Access
We agree which APIs, stages and routes are in scope, whether they are REST or HTTP type, and gather the IAM roles, Cognito test users, JWT-issuing app clients or API keys we need to call every authoriser tier.
Route and Authoriser Mapping
We map every route and method against its configured authorizationType, resource policy conditions and stage or custom domain setup before any exploitation starts.
Manual Testing
A CREST-certified tester manually tests authoriser coverage, resource policies, stage exposure, mutual TLS and backend trust, chaining findings across routes where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST API Gateway pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Amazon API Gateway Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test API Gateway For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Amazon API Gateway Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our API Gateway setup?
We need read-only access to the API’s configuration, routes, resource policies and stage settings, plus one working set of credentials for each authoriser tier in scope: an IAM role, a Cognito test user, a JWT-issuing app client, or an API key. A grey-box option, where we also review your Lambda authoriser’s source and cache settings, speeds up and deepens specific findings.
Does AWS allow penetration testing of API Gateway?
Yes. Amazon API Gateway appears on AWS’s Permitted Services list, so customer-initiated security testing of your APIs needs no prior AWS approval. AWS’s policy still prohibits denial-of-service, request-flooding and similar activity against any AWS asset, and separately lists API Gateway among its Prohibited Services for Outbound Penetration Testing, meaning you cannot use it as a platform to launch tests against other targets. We scope every engagement to stay inside AWS’s current policy.
How long does an Amazon API Gateway security review take?
A single API Gateway estate, one or two APIs with their routes, authorisers and integrations, sits in our 3-day single-estate scope, with a report typically landing around 5 working days after kickoff. Multiple APIs, a mix of REST and HTTP types, or a wider set of authoriser tiers moves into a larger scope with more testing days.
Does it matter whether our API is REST or HTTP type?
Yes, for scoping and for what we can test. REST APIs support resource policies, private VPC endpoints, API keys and usage plans, and AWS WAF, none of which exist on HTTP APIs, while HTTP APIs use a native JWT authoriser that REST APIs do not have. We confirm the type of every API in scope before we price the engagement.
What is out of scope for a single-estate API Gateway review?
AWS’s Customer Support Policy for Penetration Testing is explicit that customers are not permitted to conduct security assessments of AWS infrastructure or the AWS services themselves, so testing API Gateway’s own platform is never in scope. We test the routes, authorisers, resource policies, stages and integrations you have configured, and a separate backend system that only happens to sit behind the gateway, such as a database or a third-party API, is scoped and quoted separately.
Will testing touch live data?
We test the stage you nominate, and most engagements point at a staging or pre-production stage where test accounts and sample data already exist. If production is genuinely the only environment available, we agree exactly which routes and data are in scope in writing before testing starts, and we do not run destructive tests against real records without that agreement.
Do you need our Lambda function’s source code?
No. Testing is black-box by default against the routes, authorisers and credentials you provide. A grey-box option, where we review resource policy documents, Lambda authoriser code and cache configuration, or the backend integration’s source, is available if you want faster or deeper coverage of a specific route.
Are your testers CREST certified?
Yes. Every API Gateway engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your API Gateway setup
API Gateway checks access route by route, and nothing keeps every route configured the same way. We test every route, authoriser, resource policy and stage for what it lets through. CREST-certified testers, fixed price from £3,350 for a 3-day single-estate scope, quoted within 24 hours.
