API_final.py

import boto3
import requests
import time


# Function to list API Gateways
def list_apis():
    """
    Simulates fetching AWS API Gateway REST APIs.

    In a real scan this would query AWS via boto3. For this lab we return
    mock data so the script can run without live AWS credentials.
    """
    # Real AWS implementation (requires valid credentials):
    # client = boto3.client('apigateway')
    # response = client.get_rest_apis()
    # return response['items']

    return [
        {"id": "abc123", "name": "PublicAPI"},
        {"id": "xyz789", "name": "SecureAPI"}
    ]


# Function to check API configurations
def check_api_security(api_id):
    """
    Scope: Scan an AWS API Gateway REST API for common security
    misconfigurations and weak authentication mechanisms.

    This function checks for:
    - Missing authentication mechanisms (e.g. open / public endpoints)
    - Weak authentication (e.g. Basic Auth instead of OAuth2 / Cognito)
    - Insecure HTTP usage (unencrypted traffic instead of HTTPS)
    - Overly permissive CORS settings
    """

    # --- Task 4: Simulated API Gateway configurations ---
    mock_api_configurations = {
        "abc123": {"auth_type": "NONE", "use_https": False, "cors": "*"},
        "xyz789": {"auth_type": "COGNITO_AUTH", "use_https": True, "cors": "restricted"}
    }

    api_config = mock_api_configurations.get(api_id, {})

    print(f"\n Checking API {api_id} for security issues...\n")

    # Check for missing authentication
    if api_config.get("auth_type") == "NONE":
        print("WARNING: API has NO authentication! This API is open to the public.\n")

    # Check if HTTPS is enforced
    if not api_config.get("use_https"):
        print("WARNING: API does not enforce HTTPS! Data might be exposed in transit.\n")

    # Check for overly permissive CORS settings
    if api_config.get("cors") == "*":
        print("WARNING: API has overly permissive CORS settings. May allow cross-origin attacks.\n")

    # --- Task 5: Test for security vulnerabilities (simulated request) ---
    # Simulate sending an unauthorized request to the API endpoint to check
    # whether it is reachable without authentication.
    url = f"https://{api_id}.execute-api.us-east-1.amazonaws.com/prod"
    print(f"Sending test request to {url}...\n")

    try:
        response = requests.get(url)
        if response.status_code == 200:
            print("WARNING: API is accessible without authentication!\n")
        else:
            print("API requires authentication.\n")
    except requests.exceptions.RequestException:
        print("Unable to connect to the API (simulated scenario).\n")

    # --- Task 6: Generate and log findings ---
    # Store the scan results in a dictionary and display them as a report.
    security_findings = {"api_id": api_id, "issues": []}

    if api_config.get("auth_type") == "NONE":
        security_findings["issues"].append("Missing authentication (public access).")
    if not api_config.get("use_https"):
        security_findings["issues"].append("Insecure HTTP (HTTPS not enforced).")
    if api_config.get("cors") == "*":
        security_findings["issues"].append("Overly permissive CORS settings.")

    print("Security Findings Report:")
    if security_findings["issues"]:
        for issue in security_findings["issues"]:
            print(f"   - {issue}")
    else:
        print("   No major security issues found.")
    print()

    return security_findings


# Main function
if __name__ == "__main__":
    while True:
        print(" Running API Security Scan...\n")
        apis = list_apis()

        if not apis:
            print("No APIs found.")
        else:
            for api in apis:
                print(f"\nScanning API: {api['name']} (ID: {api['id']})")
                check_api_security(api['id'])

        print("\n Next scan in 5 minutes...\n")
        time.sleep(300)  # Wait 5 minutes before next scan