AWS AppSync API Key

Description

General

• Documentation: https://docs.aws.amazon.com/appsync/latest/devguide/security-authz.html#api-key-authorization
• Summary: AWS AppSync is a managed service to build GraphQL APIs on AWS. An API key authorizes requests to a GraphQL API that uses the API_KEY authorization mode, and is sent in the x-api-key header. AWS recommends API keys for development or for APIs that are safe to expose. A key is valid for up to 365 days, and its expiration can be extended. This detector identifies AppSync API keys, together with the GraphQL endpoint of the API when both appear together.

Details for AWS AppSync API Key

• Family: token

• Category: cloud_provider

• Company: Amazon Web Services

• High recall: False

• Validity check available: True

• Analyzer available: False

• Revoker available: True

• On-premise instances exist: False

• Only valid secrets raise an alert: False

• Occurrences found for one million commits: 3.4

• Prefixed: False

Revoker

Auth Credentials

Valid credentials needed to authenticate the request.

• admin_client_id: Access key ID of an IAM principal in the AWS account of the API, allowed to call appsync:ListGraphqlApis and appsync:DeleteApiKey

• admin_client_secret: Secret access key matching admin_client_id

HTTP Calls

List of calls performed by the revoker.

• DELETE: /v1/apis/{apiId}/apikeys/{id}
• GET: /v1/apis

Revocation Mode

Revocation is asynchronous.