"APIs provide a great opportunity for enterprises to quickly and easily develop and integrate applications. However, it’s a challenge to build enterprise-grade security measures into APIs in order to protect data and meet compliance requirements. In this workshop, you get hands-on experience applying security best practices to improve the security posture of APIs built on AWS. We examine best practices for security and many of the security features and services available on the AWS platform, including Amazon Cognito, AWS WAF, Amazon API Gateway input validation, API Gateway usage plans, API Gateway authentication and authorization, AWS X-Ray, and more.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Building Secure APIs in the cloud
S D D 4 0 3 - R
Xiang Shen
Solutions Architect
Amazon Web Services
Kevin Mccandless
Solutions Architect
Amazon Web Services

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Related breakouts
Wednesday, Jun 26
SDD401 Securing enterprise-grade serverless applications
3:30 PM–4:30 PM | Level 0, Hall B2, Yellow
Wednesday, Jun 26
SDD405-R1 Serverless identity management, authentication, and authorization
10:30 AM–12:30 PM | Level 2, Room 210B
Wednesday, Jun 26
SDD311 Using AWS WAF to protect against bots and scrapers
1:45 PM–3:45 PM | Level 1, Room 104A

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Security risks for web applications
Amazon API Gateway
Hands-on labs
Q & A

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
OWASP top 10 security risks
Rank Security risks
1 Injection
2 Broken authentication
3 Sensitive data exposure
4 XML external entities (XXE)
5 Broken access control
6 Security misconfiguration
7 Cross-site scripting (XSS)
8 Insecure deserialization
9 Using components with known
vulnerabilities
10 Insufficient logging and monitoring
https://www.owasp.org
• Exploitability
• Prevalence
• Detectability
• Technical impact

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
OWASP top 10 mapped to security domains
Infrastructure
Data
Code
Identity
and access
Logging and
monitoring
• Broken authentication (#2)
• Broken access control (#5)
• Injection (#1)
• XXE (#4)
• XSS (#7)
• Insecure deserialization (#8)
• Using components with known vulnerabilities
(#9)
• Sensitive data exposure (#3)
• Using components with known
vulnerabilities (#9)
• Security misconfiguration (#6)
• Insufficient logging and monitoring
(#10)

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Manage APIs with Amazon API Gateway
Mobile apps
Websites
Services
Internet Amazon
CloudFront
Amazon CloudWatch
monitoring
API
Gateway
cache
Any other
AWS service
All publicly
accessible
endpoints
AWS
Lambda
functions
Endpoints
in your VPC
Regional or Private
API Endpoints
AWS Lambda
functions
Endpoints on
Amazon EC2
Your VPCAWS Cloud

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Manage APIs with Amazon API Gateway
Mobile apps
Websites
Services
Internet Amazon
CloudFront
Amazon CloudWatch
monitoring
API
Gateway
cache
Any other
AWS service
All publicly
accessible
endpoints
AWS
Lambda
functions
Endpoints
in your VPC
Regional or Private
API Endpoints
AWS Lambda
functions
Endpoints on
Amazon EC2
Your VPCAWS Cloud
Resource Policy
Input Validation
WAF
Usage Plan
CORS
AuthN/Z
Private Integrations
SSL Client Authentication
AWS X-Ray

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
API Gateway: Three types of authorization
Amazon Cognito
user pools
Amazon Cognito
federated identities
Custom identity providers
AWS Identity and
Access Management
(IAM) authorization
Lambda authorizers
User pools authorizers

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
API Gateway: Three types of authorization
Amazon Cognito
user pools
Amazon Cognito
federated identities
Custom identity providers
IAM
Custom authorizers
User pools authorizers

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
API
Gateway
Amazon Cognito
user pools
DatabaseBackend
API Gateway + Amazon Cognito

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
API
Gateway
Amazon Cognito
user pools
Backend
User pools authorizers

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
API
Gateway
Amazon Cognito
user pools
• Identity
• Access
• Refresh
Backend
User pools authorizers

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
API
Gateway
Amazon Cognito
user pools
Backend
User pools authorizers

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
4. Validate identity token
API
Gateway
Amazon Cognito
user pools
Backend
User pools authorizers

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
5. Call backend
API
Gateway
Amazon Cognito
user pools
Backend
User pools authorizers

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
API Gateway: Three types of authorization
Amazon Cognito
user pools
Amazon Cognito
federated identities
Custom identity providers
IAM authorization
Custom authorizers
User pools authorizers

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
API
Gateway
Amazon Cognito
federated identities
Amazon Cognito
user pools
IAM
Backend
IAM-based authorization

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
Amazon Cognito
user pools
API
Gateway
Amazon Cognito
federated identities
IAM
Backend
IAM-based authorization

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
API
Gateway
Amazon Cognito
user pools
Amazon Cognito
federated identities
IAM
Backend
IAM-based authorization

20. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
3. Request AWS credentials
API
Gateway
Amazon Cognito
user pools
Amazon Cognito
federated identities
IAM
Backend
IAM-based authorization

21. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
4. Validate ID token
API
Gateway
Amazon Cognito
user pools
Amazon Cognito
federated identities
IAM
Backend
IAM-based authorization

22. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
5. Temp AWS credentials
API
Gateway
Amazon Cognito
user pools
Amazon Cognito
federated identities
IAM
Backend
IAM-based authorization

23. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
AmazonAPI
Gateway
Amazon Cognito
user pools
Amazon Cognito
federated identities
Backend
IAM-based authorization
IAM

24. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
API
Gateway
Amazon Cognito
user pools
Amazon Cognito
federated identities
IAM
Backend
IAM-based authorization

25. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobile app
8. Call backend
API
Gateway
Amazon Cognito
user pools
Amazon Cognito
federated identities
IAM
Backend
IAM-based authorization

26. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM policy detail
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "execute-api:Invoke",
"Effect": ”Allow",
"Resource": "arn:aws:execute-api:*:*:ff5h9tpwfh/*"
},
{
"Action": "execute-api:Invoke",
"Effect": "Deny",
"Resource": "arn:aws:execute-
api:*:*:ff5h9tpwfh/*/POST/locations/*"
}
]
}

27. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
API Gateway: Three types of authorization
Amazon Cognito
user pools
Amazon Cognito
federated identities
Custom identity providers
IAM authorization
Custom authorizers
User pools authorizers

28. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lambda authorizer
Mobileapp
API
Gateway
IAM
Backend
Lambda authorizers

29. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobileapp
API
Gateway
Lambda authorizer
Backend
Lambda authorizers
IAM

30. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobileapp
API
Gateway
Lambda authorizer
Backend
Lambda authorizers
IAM

31. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobileapp
API
Gateway
Lambda authorizer
Backend
Lambda authorizers
IAM

32. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobileapp
4. Check policy cache
API
Gateway
Lambda authorizer
Backend
Lambda authorizers
IAM

33. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobileapp
5. Validate token
API
Gateway
Lambda authorizer
Backend
Lambda authorizers
IAM

34. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lambdaauthorizer
Mobileapp
6. Generate and return
user IAM policy
API
Gateway
Backend
IAM
Lambda authorizers

35. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobileapp
API
Gateway
Lambda authorizer
Backend
IAM
Lambda authorizers

36. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mobileapp
8. Call backend
API
Gateway
Lambda authorizer
Backend
IAM
Lambda authorizers

37. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
var testPolicy = new AuthPolicy(”userIdentifier", "XXXXXXXXXXXX", apiOptions);
testPolicy.allowMethod(AuthPolicy.HttpVerb.POST, "/locations/*");
testPolicy.allowMethod(AuthPolicy.HttpVerb.DELETE, "/locations/*");
callback(null, testPolicy.getPolicy());
Sample code
Lambda authorizers

38. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
VPC
AWS Cloud
Availability Zone 1 Availability Zone 2
NAT Gateway
lab-backend
Workshop labs – Starting point
Private subnet1 Private subnet2
Public subnet1 Public subnet2
NAT Gateway
AWS Cloud9
Internet gateway

39. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
VPC
AWS Cloud
Availability Zone 1 Availability Zone 2
NAT Gateway
lab-backend
Lab project architecture
Private subnet1 Private subnet2
Public subnet1 Public subnet2
NAT Gateway
API Gateway
AWS Cloud9
Internet gateway
Network Load Balancing
Amazon Cognito AWS X-Ray CloudWatch

40. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Hands-on labs
http://bit.ly/2WFWKiD
http://workshop.reinforce.awsdemo.me/

41. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.