Skip to content

feat(aws): add apigateway_domain_name_pqc_tls_enabled check - #11316

Merged
HugoPBrito merged 10 commits into
masterfrom
feat/apigateway-domain-name-pqc-tls-enabled
Jun 22, 2026
Merged

feat(aws): add apigateway_domain_name_pqc_tls_enabled check#11316
HugoPBrito merged 10 commits into
masterfrom
feat/apigateway-domain-name-pqc-tls-enabled

Conversation

@pedrooot

@pedrooot pedrooot commented May 21, 2026

Copy link
Copy Markdown
Member

Context

To mitigate "harvest now, decrypt later" attacks, API Gateway offers enhanced TLS security policies that add hybrid post-quantum (ML-KEM) key exchange for REST API custom domain names. Prowler had no check surfacing whether a custom domain uses one.

Description

Adds the apigateway_domain_name_pqc_tls_enabled check. It evaluates the securityPolicy of every REST API custom domain name against a configurable allowlist (apigateway_pqc_tls_allowed_policies, default: SecurityPolicy_TLS13_1_3_2025_09). The apigateway service is extended to list custom domain names. Severity: low.

Note: API Gateway HTTP and WebSocket APIs only support the legacy TLS_1_2 policy today, so they cannot use post-quantum TLS and are out of scope for this check.

Steps to review

  1. Check implementation: prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/
  2. Service change listing custom domain names: prowler/providers/aws/services/apigateway/apigateway_service.py
  3. Run the tests: poetry run pytest tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/ tests/providers/aws/services/apigateway/apigateway_service_test.py -v
  4. Optionally run against a real environment: prowler aws --check apigateway_domain_name_pqc_tls_enabled

Checklist

Community Checklist
  • This feature/issue is listed in here or roadmap.prowler.com
  • Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

SDK/CLI

  • Are there new checks included in this PR? Yes
    • Yes, permissions updated: adds apigateway:GET on arn:*:apigateway:*::/domainnames/* to both permissions/prowler-additions-policy.json and the CloudFormation scan-role template, required to read custom domain names.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Summary by CodeRabbit

  • New Features
    • Added the apigateway_domain_name_pqc_tls_enabled check for API Gateway custom domains to ensure they use an approved post-quantum TLS security policy.
    • Introduced apigateway_pqc_tls_allowed_policies (default allowlist) to control which policies are considered valid.
  • Documentation
    • Updated the configuration-file tutorial and changelog to describe the new check and setting.
  • Bug Fixes
    • Extended API Gateway read-only IAM permissions to include custom domain name resources.
  • Tests
    • Added coverage for default-vs-configured allowlist behavior and for custom domain discovery.

@pedrooot
pedrooot requested review from a team as code owners May 21, 2026 22:19
@mintlify

mintlify Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated (UTC)
prowler 🟢 Ready View Preview May 21, 2026, 10:20 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

@github-actions github-actions Bot added documentation provider/aws Issues/PRs related with the AWS provider compliance Issues/PRs related with the Compliance Frameworks metadata-review labels May 21, 2026
@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

✅ All necessary CHANGELOG.md files have been updated.

@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

Compliance Mapping Review

This PR adds new checks. Please verify that they have been mapped to the relevant compliance framework requirements.

New checks already mapped in this PR

  • apigateway_domain_name_pqc_tls_enabled (aws): aws_well_architected_framework_security_pillar_aws, ccc_aws, ens_rd2022_aws, fedramp_moderate_revision_4_aws, ffiec_aws, gxp_21_cfr_part_11_aws, iso27001_2013_aws, kisa_isms_p_2023_aws, kisa_isms_p_2023_korean_aws, nist_800_171_revision_2_aws, nist_800_53_revision_5_aws, rbi_cyber_security_framework_aws, secnumcloud_3.2_aws

Use the no-compliance-check label to skip this check.

@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

@codecov

codecov Bot commented May 21, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 95.23810% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 8.11%. Comparing base (30d737c) to head (15a5584).
⚠️ Report is 4 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (30d737c) and HEAD (15a5584). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (30d737c) HEAD (15a5584)
api 1 0
Additional details and impacted files
@@             Coverage Diff             @@
##           master   #11316       +/-   ##
===========================================
- Coverage   94.12%    8.11%   -86.01%     
===========================================
  Files         247      976      +729     
  Lines       36541    34194     -2347     
===========================================
- Hits        34393     2774    -31619     
- Misses       2148    31420    +29272     
Flag Coverage Δ
api ?
prowler-py3.10-aws 3.15% <95.23%> (?)
prowler-py3.10-config 8.11% <95.23%> (?)
prowler-py3.10-external 8.03% <95.23%> (?)
prowler-py3.11-aws 3.15% <95.23%> (?)
prowler-py3.11-config 8.11% <95.23%> (?)
prowler-py3.11-external 8.03% <95.23%> (?)
prowler-py3.12-aws 3.15% <95.23%> (?)
prowler-py3.12-config 8.11% <95.23%> (?)
prowler-py3.12-external 8.03% <95.23%> (?)
prowler-py3.13-aws 3.15% <95.23%> (?)
prowler-py3.13-config 8.11% <95.23%> (?)
prowler-py3.13-external 8.03% <95.23%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Δ
prowler 8.00% <65.57%> (∅)
api ∅ <ø> (∅)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

🔒 Container Security Scan

Image: prowler:833ebdc
Last scan: 2026-06-22 15:09:01 UTC

✅ No Vulnerabilities Detected

The container image passed all security checks. No known CVEs were found.

📋 Resources:

@coderabbitai

coderabbitai Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Adds a new Prowler check apigateway_domain_name_pqc_tls_enabled that audits API Gateway REST custom domain names for post-quantum TLS security policies. The service layer gains a DomainName model and concurrent _get_domain_names fetch; IAM permissions are extended to cover /domainnames/*; default configuration, metadata, Helm values, docs, and comprehensive tests are all introduced.

Changes

API Gateway Post-Quantum TLS Check

Layer / File(s) Summary
DomainName model and service data collection
prowler/providers/aws/services/apigateway/apigateway_service.py
Adds Any import, initializes self.domain_names in APIGateway.__init__, implements _get_domain_names to paginate get_domain_names, construct ARNs from partition and region, apply resource filtering, and populate the collection with DomainName instances carrying name, ARN, region, security_policy, and tags.
IAM permissions for domain name read access
permissions/prowler-additions-policy.json, permissions/templates/cloudformation/prowler-scan-role.yml
Extends AllowAPIGatewayReadOnly in both the standalone IAM policy and the CloudFormation ProwlerScan role template to include arn:*:apigateway:*::/domainnames/* alongside the existing /apis/* resource ARN.
Check logic, metadata, and configuration defaults
prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py, .../apigateway_domain_name_pqc_tls_enabled.metadata.json, prowler/config/config.yaml, contrib/k8s/helm/prowler-api/values.yaml
Implements apigateway_domain_name_pqc_tls_enabled check with _get_allowed_policies helper and per-domain PASS/FAIL logic; adds full check metadata with description, remediation (CLI/CloudFormation/Terraform), recommendation, and REST-only scope notes; registers apigateway_pqc_tls_allowed_policies in the default config and Helm values with SecurityPolicy_TLS13_1_3_2025_09.
Service and check unit tests
tests/providers/aws/services/apigateway/apigateway_service_test.py, tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py
Adds test_get_domain_names using moto for service-level validation; adds a full check test module with _build_client helper and seven scenarios: no domains (empty), PQ policy match (PASS), legacy TLS 1.2 (FAIL), missing security_policy (FAIL), configurable allowlist override (PASS), null config fallback to default, and non-iterable config fallback to default.
Documentation and changelog
docs/user-guide/cli/tutorials/configuration_file.mdx, prowler/CHANGELOG.md
Adds the apigateway_domain_name_pqc_tls_enabled check row to the AWS Configurable Checks table mapping to apigateway_pqc_tls_allowed_policies (List of Strings), and records the new check under the [5.31.0] UNRELEASED changelog section.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested reviewers

  • danibarranqueroo
  • lydiavilchez
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 13.33% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: adding a new AWS API Gateway check for post-quantum TLS on custom domain names.
Description check ✅ Passed The description covers context, implementation details, review steps, and a completed checklist, but misses some non-critical sections like README.md review and backport assessment.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/apigateway-domain-name-pqc-tls-enabled

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py (1)

27-156: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use moto for AWS Check Tests to Match Repository Standard

These AWS check tests currently rely only on MagicMock.
As per coding guidelines, "Tests: AWS uses moto @mock_aws + set_mocked_aws_provider; Azure/GCP/K8s/other providers use MagicMock (NO moto)."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py`
around lines 27 - 156, The test class
`Test_apigateway_domain_name_pqc_tls_enabled` needs to be refactored to use
moto's `@mock_aws` decorator in addition to the existing `MagicMock` setup to
follow AWS check testing standards. Import `mock_aws` from the moto library and
apply it as a decorator to the test class, then verify that all test methods
(test_no_domains, test_pq_policy, test_legacy_tls_1_2,
test_missing_security_policy, and test_configurable_allowlist) continue to work
with the combined moto and MagicMock mocking approach.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/user-guide/cli/tutorials/configuration_file.mdx`:
- Line 58: The newly documented configurable check mapping for
`apigateway_domain_name_pqc_tls_enabled` to
`apigateway_pqc_tls_allowed_policies` is missing a Version Badge component.
Locate the section header or title that introduces this new configuration
mapping and add a VersionBadge component on its own line immediately after the
header using the format `<VersionBadge version="X.Y.Z" />` where X.Y.Z is the
appropriate version number when this feature was introduced in Prowler.

In
`@prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py`:
- Line 18: The execute method is missing a docstring which is required for all
public methods in Python. Add a docstring immediately after the method
definition of execute that clearly describes what the method does, its
parameters if any, and its return type (list[Check_Report_AWS]). The docstring
should follow the project's documentation conventions and provide clear context
about the method's purpose and behavior.
- Around line 20-27: The code retrieves pqc_policies from audit_config using a
get method that could return null or a non-iterable value if misconfigured in
the audit settings. Before the membership check `if domain.security_policy in
pqc_policies` on line 26, add validation to ensure pqc_policies is actually
iterable (a list or set). If the value is null or not iterable, either assign it
to a default empty list or the PQC_APIGATEWAY_POLICIES_DEFAULT constant to
prevent a TypeError when the in operator is executed.

In `@prowler/providers/aws/services/apigateway/apigateway_service.py`:
- Line 24: Add Google-style docstrings to the `_get_domain_names` method and to
the class/definition at line 281. Each docstring should follow Google's
documentation format, including a brief summary of what the method/class does, a
description of parameters (Args), return value (Returns), and any exceptions
(Raises) if applicable. Place the docstring immediately after the method/class
definition line, enclosed in triple quotes.

---

Outside diff comments:
In
`@tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py`:
- Around line 27-156: The test class
`Test_apigateway_domain_name_pqc_tls_enabled` needs to be refactored to use
moto's `@mock_aws` decorator in addition to the existing `MagicMock` setup to
follow AWS check testing standards. Import `mock_aws` from the moto library and
apply it as a decorator to the test class, then verify that all test methods
(test_no_domains, test_pq_policy, test_legacy_tls_1_2,
test_missing_security_policy, and test_configurable_allowlist) continue to work
with the combined moto and MagicMock mocking approach.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: cdf3e5fa-fedc-4290-bbbc-6c0996e1096f

📥 Commits

Reviewing files that changed from the base of the PR and between 6177fc6 and 8857351.

⛔ Files ignored due to path filters (14)
  • prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/ccc_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/csa_ccm_4.0_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/ens_rd2022_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/fedramp_moderate_revision_4_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/ffiec_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/gxp_21_cfr_part_11_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/iso27001_2013_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/kisa_isms_p_2023_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/nist_800_171_revision_2_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/nist_800_53_revision_5_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/rbi_cyber_security_framework_aws.json is excluded by !prowler/compliance/**/*.json
  • prowler/compliance/aws/secnumcloud_3.2_aws.json is excluded by !prowler/compliance/**/*.json
📒 Files selected for processing (13)
  • contrib/k8s/helm/prowler-api/values.yaml
  • docs/user-guide/cli/tutorials/configuration_file.mdx
  • permissions/prowler-additions-policy.json
  • permissions/templates/cloudformation/prowler-scan-role.yml
  • prowler/CHANGELOG.md
  • prowler/config/config.yaml
  • prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/__init__.py
  • prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.metadata.json
  • prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py
  • prowler/providers/aws/services/apigateway/apigateway_service.py
  • tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/__init__.py
  • tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py
  • tests/providers/aws/services/apigateway/apigateway_service_test.py

Comment thread docs/user-guide/cli/tutorials/configuration_file.mdx
Comment thread prowler/providers/aws/services/apigateway/apigateway_service.py Outdated
- Normalize configurable PQC policy allowlist

- Add focused tests and SDK docstrings

- Add version badge for configurable check docs

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
prowler/providers/aws/services/apigateway/apigateway_service.py (1)

47-47: ⚠️ Potential issue | 🟡 Minor

Fix tags field wrapping inconsistency in DomainName and RestAPI initialization.

Line 47 wraps the tags dict in a list: tags=[item.get("tags", {})], producing [{}] when tags are missing. This conflicts with the DomainName model default tags: Optional[list] = []. Similarly, line 71 uses tags=[apigw.get("tags")] for RestAPI, producing [None] when tags are absent. The Stage model (line ~173) has the same issue.

AWS API responses provide tags as a dict (or absent entirely), not a list. The wrapping creates inconsistent data: missing tags should be [] per the model default, not [{}] or [None].

Change line 47 to tags=item.get("tags") and line 71 to tags=apigw.get("tags") to pass the value directly, allowing Pydantic to apply the model default when tags are None.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@prowler/providers/aws/services/apigateway/apigateway_service.py` at line 47,
Remove the list wrapping around the tags field in the DomainName, RestAPI, and
Stage model initializations. In the DomainName initialization at line 47, change
tags=[item.get("tags", {})] to tags=item.get("tags") to pass the tags dict
directly instead of wrapping it in a list. Similarly, update line 71 in the
RestAPI initialization from tags=[apigw.get("tags")] to tags=apigw.get("tags"),
and apply the same fix to the Stage model initialization around line 173. This
allows Pydantic to apply the model default of an empty list when tags are absent
or None, rather than creating inconsistent data structures like [{}] or [None].
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py`:
- Around line 11-15: The _get_allowed_policies helper function parameter
`configured_policies` is missing a type annotation. Add an explicit type hint
`Any` to the `configured_policies` parameter to clarify that this helper
function accepts any type before validating it with isinstance. This improves
code clarity and aligns with coding guidelines for type hints.

---

Outside diff comments:
In `@prowler/providers/aws/services/apigateway/apigateway_service.py`:
- Line 47: Remove the list wrapping around the tags field in the DomainName,
RestAPI, and Stage model initializations. In the DomainName initialization at
line 47, change tags=[item.get("tags", {})] to tags=item.get("tags") to pass the
tags dict directly instead of wrapping it in a list. Similarly, update line 71
in the RestAPI initialization from tags=[apigw.get("tags")] to
tags=apigw.get("tags"), and apply the same fix to the Stage model initialization
around line 173. This allows Pydantic to apply the model default of an empty
list when tags are absent or None, rather than creating inconsistent data
structures like [{}] or [None].
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 938561e2-1672-456b-b9b4-a70501ee7b91

📥 Commits

Reviewing files that changed from the base of the PR and between 8857351 and 581a83a.

📒 Files selected for processing (4)
  • docs/user-guide/cli/tutorials/configuration_file.mdx
  • prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py
  • prowler/providers/aws/services/apigateway/apigateway_service.py
  • tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py

- Resolve CSA CCM compliance catalog conflict by keeping master removal

- Add requested helper parameter type annotation
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jun 19, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jun 22, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jun 22, 2026
HugoPBrito
HugoPBrito previously approved these changes Jun 22, 2026
@HugoPBrito
HugoPBrito merged commit ca48fd0 into master Jun 22, 2026
41 of 42 checks passed
@HugoPBrito
HugoPBrito deleted the feat/apigateway-domain-name-pqc-tls-enabled branch June 22, 2026 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

compliance Issues/PRs related with the Compliance Frameworks documentation metadata-review new-check provider/aws Issues/PRs related with the AWS provider

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants