search

openclarity / apiclarity

An API security tool to capture and analyze API traffic, test API endpoints, reconstruct Open API specification, and identify API security risks. 
https://apiclarity.io
Apache License 2.0
498 stars 64 forks source link

Support for AWS API Gateway with Lambda proxy integration #357

Open au-phiware opened 1 year ago

au-phiware commented 1 year ago

I'm looking to contribute an integration between AWS API Gateway and APIClarity using a Lambda proxy integration as a POC. My initial thoughts is to build a proxy that converts the input and output formats of AWS API Gateway into the schema of the plugin API.

Are you aware of any prior work that uses APIClarity in an AWS environment (outside of k8s)?

jubarbot-cisco commented 1 year ago

Hi @au-phiware, Thank you for reaching out ! Your idea makes perfect sense. I'm not aware of any work about using AWS lambdas to push traces to APIClarity.

Keep in mind that the Trace Source (Kong gateway, istio proxy, AWS lambda) can be running in one environment, and APIClarity in another.

APIClarity can also run on you local machine (no Kubernetes involved) or inside a virtual machine, running in AWS, as long as the Trace Source can send traces to APIClarity. The only thing that you will miss, is the BFLA (Broken Function Level Authorization) feature which relies on the K8S API.

Feel free to contribute, we will be more than happy to help you.

Thank you !