aws-apigw-wildcard-policy-public

A REST API resource policy with Principal '*' and no VPC/IP restriction makes the API internet-callable.

derived aws emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`PublicEndpoint`
target type	`AnonymousIdentity`
source	`<public execute-api endpoint of ?api>`
target	`<AnonymousIdentity>`
permissions	`execute-api:Invoke`
conditions	`resource_policy`
state logic	ACTIVE when the resource policy unconditionally allows execute-api:Invoke from Principal '*'. CONDITIONAL(condition_expression) when a condition limits to a PrincipalOrgID or specific IP range (not internet-open). BLOCKED when an explicit Deny statement overrides the Allow.

source type

PublicEndpoint

target type

AnonymousIdentity

source

<public execute-api endpoint of ?api>

target

<AnonymousIdentity>

permissions

execute-api:Invoke

conditions

resource_policy

state logic

ACTIVE when the resource policy unconditionally allows execute-api:Invoke from Principal '*'. CONDITIONAL(condition_expression) when a condition limits to a PrincipalOrgID or specific IP range (not internet-open). BLOCKED when an explicit Deny statement overrides the Allow.

Narrative

{api.name}'s resource policy grants execute-api:Invoke to Principal '*' without VPC/IP restriction, making the API callable from the public internet.

Raw rule rules/derived/aws/apigateway.yaml

id: aws-apigw-wildcard-policy-public
emits: ExposedToInternet
description: A REST API resource policy with Principal '*' and no VPC/IP restriction makes the API internet-callable.
match:
- - api: null
  - HasPolicy
  - policy: null
where:
- node_type(?api)    == APIGateway
- node_type(?policy) == ResourcePolicy
- ?policy grants execute-api:Invoke with Principal '*' and Effect Allow
- no Deny statement or condition restricts to aws:sourceVpce / aws:SourceVpc / aws:sourceIp on that statement
emit:
  source_type: PublicEndpoint
  target_type: AnonymousIdentity
  source: <public execute-api endpoint of ?api>
  target: <AnonymousIdentity>
  permissions:
  - execute-api:Invoke
  conditions:
  - resource_policy
  state_logic: ACTIVE when the resource policy unconditionally allows execute-api:Invoke from Principal
    '*'. CONDITIONAL(condition_expression) when a condition limits to a PrincipalOrgID or specific IP
    range (not internet-open). BLOCKED when an explicit Deny statement overrides the Allow.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?api HasPolicy ?policy (Principal '*' Allow execute-api:Invoke)
  false_positive_note: "A Private endpoint-type API with a wildcard-allow resource policy is still not\
    \ internet-reachable at the network level \u2014 emit ExposedToAccount (VPC-internal) rather than\
    \ ExposedToInternet. For REGIONAL/EDGE APIs a wildcard policy is true internet exposure. Do NOT emit\
    \ for V2 (HTTP/WebSocket) \u2014 V2 has no resource policy. Deduplicate with aws-apigw-public-exposure\
    \ on (ExposedToInternet, ?api, AnonymousIdentity) \u2014 emit once."
  narrative: '{api.name}''s resource policy grants execute-api:Invoke to Principal ''*'' without VPC/IP
    restriction, making the API callable from the public internet.'