Contact Us 1-800-596-4880
  1. Homepage
  2. Exchange
  3. Administrator Tasks
  4. Discovering and Cataloging External Services with Scanners
  5. API Scanners

  6. Adding a Scanner for Amazon API Gateway

Adding a Scanner for Amazon API Gateway

Add a scanner to discover, import, and sync APIs from Amazon API Gateway into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal.

The scanner discovers policies attached to supported Amazon API Gateway API, stage, route, and integration configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API. Policies outside the supported scanner coverage aren’t currently scanned.

Before You Begin

Before adding the scanner, verify that you have these prerequisites:

For discovering and importing APIs:

  • Exchange Administrator permission

  • Knowledge about the Amazon Web Services region where the services are deployed.

  • AWS access key ID

  • AWS secret access key

Additional requirements for discovering and reading policies:

  • IAM policy with read permissions for Amazon API Gateway:

    • apigateway:GET

    • apigateway:GET* actions on REST and HTTP API resources

  • Resource scope:

    • arn:aws:apigateway:{region}::/restapis/*

    • arn:aws:apigateway:{region}::/apis/*

      For web application firewall (WAF) policies, the scanner also uses software.amazon.awssdk:wafv2 and software.amazon.awssdk:route53.

Example custom IAM policy for read-only access:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["apigateway:GET"],
      "Resource": "*"
    }
  ]
}

Policy Coverage for Amazon API Gateway

The scanner reads and extracts these policy areas from AWS API Gateway configurations:

Policy area What the scanner reads

Authentication and authorization

IAM signature enforcement (aws-iam), Cognito/custom authorizers (cognito-authorizer), and API key requirements (api-key-required).

Rate limiting and quotas

Usage plan throttles and quotas, stage and method throttles, and account-level default throttle settings.

Network and access control

Resource policies (including IP-filter conditions), mutual TLS settings, and CORS-related request filtering.

Application firewall and threat protection

WAF Web ACLs, WAF IP filtering rules, WAF size restrictions, and WAF bot control rules.

Traffic, resilience, and optimization

Canary settings, Route53 health-check associations, and API cache settings.

Request and response processing

Integration timeout settings, header mappings, VTL mapping templates, request validators, and integration type patterns (including Step Functions and mock integrations).

Observability

Access logging, X-Ray tracing, and CloudWatch metrics.

Policies that aren’t represented in this supported coverage list aren’t currently scanned by this Amazon API Gateway scanner.

The scanner doesn’t currently read these policy areas:

Policy area not scanned Reason

JWT check (jwt-check)

JWT authorizers are tied to HTTP API v2 patterns and aren’t covered by this scanner’s current API model.

Attribute-based access control (attribute-based-access-control)

There isn’t a reliable API-to-policy linkage signal in the current scanner flow.

Tokenization (tokenization)

This is typically enforced in downstream services (for example, Lambda/KMS usage), not directly in API Gateway configuration.

PII protection (pii-protection)

This is typically implemented in downstream processing services, not as direct API Gateway policy configuration.

Add a Scanner for Amazon API Gateway

  1. Verify that you are in the business group where you want to add the scanner.

  2. From the sidebar in Exchange, click Scanners.

  3. Enter a name for the scanner.

  4. From Scanner Run Configuration, complete these fields or options:

    Field/Option Value

    Run Schedule

    Select a frequency and local time.

    Sync Review

    Select an option: Auto-resolve or Ask to review.

  5. From Connection Configuration, complete these fields:

    Field Value

    Provider

    Select Amazon.

    Platform

    Select API Gateway.

    Service Type

    REST APIs selected by default.

    Authentication Method

    Access key selected by default.

    AWS Access Key ID

    Enter the access key ID.

    AWS Secret Access Key

    Enter the secret access key.

    AWS Region

    Select a region.

  6. Click Test Connection.

    If the connection fails, review the Connection Configuration settings. Update the settings, and then test the connection again.

  7. To send email notifications:

    1. Select Advanced Settings and turn on Send Email Notifications.

    2. Enter an email address.

  8. Click Add Scanner.

See Also