AWS apigateway medium security documentation change
Summary
Removed conditional logging limitations for mutual TLS client certificate variables
Security assessment
The change removes 'Present only in access logs if mutual TLS authentication fails' from all client certificate logging variables. This indicates successful mTLS authentications will now log certificate details, improving security auditing capabilities. Previously, critical certificate details were only logged during failures, creating a security visibility gap.
Diff
diff --git a/apigateway/latest/developerguide/api-gateway-variables-for-access-logging.md b/apigateway/latest/developerguide/api-gateway-variables-for-access-logging.md index 0ca4c2f57..ca9e3e8dd 100644 --- a//apigateway/latest/developerguide/api-gateway-variables-for-access-logging.md +++ b//apigateway/latest/developerguide/api-gateway-variables-for-access-logging.md @@ -69,6 +69,6 @@ Calling `$context.authorizer.key` returns the `"value"` string, calling `$contex -`$context.identity.clientCert.clientCertPem` | The PEM-encoded client certificate that the client presented during mutual TLS authentication. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. -`$context.identity.clientCert.subjectDN` | The distinguished name of the subject of the certificate that a client presents. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. -`$context.identity.clientCert.issuerDN` | The distinguished name of the issuer of the certificate that a client presents. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. -`$context.identity.clientCert.serialNumber` | The serial number of the certificate. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. -`$context.identity.clientCert.validity.notBefore` | The date before which the certificate is invalid. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. -`$context.identity.clientCert.validity.notAfter` | The date after which the certificate is invalid. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. +`$context.identity.clientCert.clientCertPem` | The PEM-encoded client certificate that the client presented during mutual TLS authentication. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. +`$context.identity.clientCert.subjectDN` | The distinguished name of the subject of the certificate that a client presents. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. +`$context.identity.clientCert.issuerDN` | The distinguished name of the issuer of the certificate that a client presents. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. +`$context.identity.clientCert.serialNumber` | The serial number of the certificate. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. +`$context.identity.clientCert.validity.notBefore` | The date before which the certificate is invalid. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. +`$context.identity.clientCert.validity.notAfter` | The date after which the certificate is invalid. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled.