A public API, which can be requested by any authenticated or unauthenticated identities, can lead to unauthorized actions and information disclosures.
The public API:
There is a risk if you answered yes to any of those questions.
It’s recommended to restrict API access to authorized entities, unless the API offers a non-sensitive service designed to be public.
A public API that doesn’t have access control implemented:
resource "aws_api_gateway_method" "noncompliantapi" {
authorization = "NONE" # Sensitive
http_method = "GET"
}
An API that implements AWS IAM permissions:
resource "aws_api_gateway_method" "compliantapi" {
authorization = "AWS_IAM"
http_method = "GET"
}