AWS apigateway high security documentation change
Summary
Added warning about security policy reset when using mode=overwrite in API imports
Security assessment
Explicitly warns that security policies and authorization configurations are reset to defaults during overwrite operations. This addresses a security misconfiguration risk where critical security settings could be accidentally removed. Concrete evidence: direct mention of 'security policies' and 'authorization configurations' being affected.
Diff
diff --git a/apigateway/latest/developerguide/api-gateway-import-api-update.md b/apigateway/latest/developerguide/api-gateway-import-api-update.md index 10add5721..f5f9ea79c 100644 --- a//apigateway/latest/developerguide/api-gateway-import-api-update.md +++ b//apigateway/latest/developerguide/api-gateway-import-api-update.md @@ -39,0 +40,6 @@ When an API (`A`) overwrites another API (`B`), the resulting API takes the defi +###### Important + +When you use `mode=overwrite`, the entire API definition is replaced. Any API configurations not explicitly included in the import body are reset to their default values. This includes settings such as security policies, authorization configurations, and other API-level properties. + +To preserve existing configurations, use `mode=merge`, which preserves existing configurations that are not specified in the import body. If you use `mode=overwrite`, ensure that your OpenAPI definition includes all desired API configurations, such as API Gateway extensions. +