You had questions, and we’ve got answers!
Is there a way to add specific rules to the allowlist?
There are two things you can do today: one is annotating operations or an API so that no authentication checks are required. If the security section is present though, that will take precedence. You can also influence operations sensitivity to increase/decrease the points assigned to a problem.
We are working on allowing users to specify a list of checks which must not be taken in account for scoring. They will still be reported but will not affect the score. The goal is that this is decided by the security team at the organization level.
What are the parameters in OpenAPI for the API firewall? How do you configure that?
The API Firewall directly interprets the OAS file contents.
I’m using the VS extension, but it fails every time since a path is not defined. Is there a way to still run tests even though there is no path defined?
Please open a ticket here, attaching the file if you can and we will fix that ASAP.
How do you do security testing on API-driven applications via lambda functions for beginners in API security?
My recommendation would be to start with being familiar with OWASP Top 10 project for API Security and diving into the OWASP cheat sheets attached to those issues.
The threats mentioned in that OWASP list are independent from the implementation and therefore you will need to adapt the implementation recommendations to AWS Lambda.
Try our security audit for free. If you want to see the whole platform in action, request a demo now!
