Implementing API Gateway Security Controls

API网关安全控制实现

When to Use

适用场景

Deploying a centralized authentication and authorization layer for microservice APIs
Implementing rate limiting, throttling, and quota management across all API endpoints
Configuring request/response validation against OpenAPI specifications at the gateway level
Setting up TLS termination, mutual TLS, and certificate management for API traffic
Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns

Do not use as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.

为微服务API部署集中式认证与授权层
在所有API端点上实现速率限制、流量控制与配额管理
在网关层基于OpenAPI规范配置请求/响应验证
为API流量设置TLS终止、双向TLS（mTLS）及证书管理
将WAF规则与API网关集成，阻止注入攻击、XSS攻击及已知攻击模式

请勿将其作为唯一安全层。API网关提供纵深防御，但后端服务仍需验证授权与输入。

Prerequisites

前置条件

API gateway platform selected and deployed (Kong, AWS API Gateway, Azure APIM, or Apigee)
OpenAPI/Swagger specifications for all backend APIs
TLS certificates for the gateway domain
Identity provider (IdP) configured for OAuth2/OIDC (Okta, Auth0, Azure AD)
Monitoring and logging infrastructure (CloudWatch, Datadog, ELK)
Backend service endpoints registered and reachable from the gateway

已选择并部署API网关平台（Kong、AWS API Gateway、Azure APIM或Apigee）
所有后端API的OpenAPI/Swagger规范
网关域名的TLS证书
已配置OAuth2/OIDC身份提供商（IdP）（如Okta、Auth0、Azure AD）
监控与日志基础设施（如CloudWatch、Datadog、ELK）
后端服务端点已注册且可从网关访问

Workflow

实施流程

Step 1: Kong Gateway Security Configuration

步骤1：Kong网关安全配置

yaml

undefined

yaml

undefined

kong.yml - Declarative Kong configuration with security plugins

kong.yml - 包含安全插件的Kong声明式配置

_format_version: "3.0"

services:

name: user-service url: http://user-service:8080 routes:
- name: user-api paths:
  - /api/v1/users methods:
  - GET
  - POST
  - PUT
  - PATCH
  - DELETE strip_path: false

plugins:

1. Authentication: JWT validation

name: jwt config: uri_param_names: - jwt header_names: - Authorization claims_to_verify: - exp maximum_expiration: 3600 # Max 1 hour token TTL

2. Rate Limiting

name: rate-limiting config: minute: 60 hour: 1000 policy: redis redis_host: redis redis_port: 6379 fault_tolerant: true hide_client_headers: false limit_by: credential # Per-user, not per-IP

3. Request Size Limiting

name: request-size-limiting config: allowed_payload_size: 1 # 1 MB max size_unit: megabytes

4. IP Restriction (admin endpoints)

name: ip-restriction service: admin-service config: allow: - 10.0.0.0/8 - 172.16.0.0/12

5. Bot Detection

name: bot-detection config: deny: - "sqlmap" - "nikto" - "nmap" - "masscan"

6. CORS Configuration

name: cors config: origins: - "https://app.example.com" methods: - GET - POST - PUT - PATCH - DELETE headers: - Authorization - Content-Type credentials: true max_age: 3600

7. Response Transformer - Remove sensitive headers

name: response-transformer config: remove: headers: - X-Powered-By - Server add: headers: - "X-Content-Type-Options: nosniff" - "X-Frame-Options: DENY" - "Strict-Transport-Security: max-age=31536000; includeSubDomains" - "Content-Security-Policy: default-src 'none'"

undefined

_format_version: "3.0"

services:

name: user-service url: http://user-service:8080 routes:
- name: user-api paths:
  - /api/v1/users methods:
  - GET
  - POST
  - PUT
  - PATCH
  - DELETE strip_path: false

plugins:

1. 认证：JWT验证

name: jwt config: uri_param_names: - jwt header_names: - Authorization claims_to_verify: - exp maximum_expiration: 3600 # 令牌最长有效期1小时

2. 速率限制

name: rate-limiting config: minute: 60 hour: 1000 policy: redis redis_host: redis redis_port: 6379 fault_tolerant: true hide_client_headers: false limit_by: credential # 按用户限制，而非按IP

3. 请求大小限制

name: request-size-limiting config: allowed_payload_size: 1 # 最大1MB size_unit: megabytes

4. IP限制（管理端点）

name: ip-restriction service: admin-service config: allow: - 10.0.0.0/8 - 172.16.0.0/12

5. 机器人检测

name: bot-detection config: deny: - "sqlmap" - "nikto" - "nmap" - "masscan"

6. CORS配置

name: cors config: origins: - "https://app.example.com" methods: - GET - POST - PUT - PATCH - DELETE headers: - Authorization - Content-Type credentials: true max_age: 3600

7. 响应转换器 - 移除敏感头信息

name: response-transformer config: remove: headers: - X-Powered-By - Server add: headers: - "X-Content-Type-Options: nosniff" - "X-Frame-Options: DENY" - "Strict-Transport-Security: max-age=31536000; includeSubDomains" - "Content-Security-Policy: default-src 'none'"

undefined

Step 2: AWS API Gateway Security Configuration

步骤2：AWS API Gateway安全配置

python

import boto3
import json

apigw = boto3.client('apigatewayv2')

python

import boto3
import json

apigw = boto3.client('apigatewayv2')

Create API with mutual TLS

创建支持双向TLS的API

api_response = apigw.create_api( Name='secure-api', ProtocolType='HTTP', DisableExecuteApiEndpoint=True, # Force custom domain ) api_id = api_response['ApiId']

api_response = apigw.create_api( Name='secure-api', ProtocolType='HTTP', DisableExecuteApiEndpoint=True, # 强制使用自定义域名 ) api_id = api_response['ApiId']

Configure authorizer (JWT with Cognito)

配置授权器（基于Cognito的JWT）

authorizer = apigw.create_authorizer( ApiId=api_id, AuthorizerType='JWT', IdentitySource='$request.header.Authorization', Name='cognito-jwt-authorizer', JwtConfiguration={ 'Audience': ['your-app-client-id'], 'Issuer': 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxx' } )

Create route with authorizer

创建带授权器的路由

apigw.create_route( ApiId=api_id, RouteKey='GET /api/v1/users', AuthorizerId=authorizer['AuthorizerId'], AuthorizationType='JWT', )

Configure throttling

配置流量控制

apigw.create_stage( ApiId=api_id, StageName='prod', DefaultRouteSettings={ 'ThrottlingBurstLimit': 100, 'ThrottlingRateLimit': 50.0, # 50 requests per second }, AccessLogSettings={ 'DestinationArn': 'arn:aws:logs:us-east-1:123456789:log-group:api-access-logs', 'Format': json.dumps({ 'requestId': '$context.requestId', 'ip': '$context.identity.sourceIp', 'caller': '$context.identity.caller', 'user': '$context.identity.user', 'requestTime': '$context.requestTime', 'httpMethod': '$context.httpMethod', 'resourcePath': '$context.resourcePath', 'status': '$context.status', 'protocol': '$context.protocol', 'responseLength': '$context.responseLength' }) } )

apigw.create_stage( ApiId=api_id, StageName='prod', DefaultRouteSettings={ 'ThrottlingBurstLimit': 100, 'ThrottlingRateLimit': 50.0, # 每秒50次请求 }, AccessLogSettings={ 'DestinationArn': 'arn:aws:logs:us-east-1:123456789:log-group:api-access-logs', 'Format': json.dumps({ 'requestId': '$context.requestId', 'ip': '$context.identity.sourceIp', 'caller': '$context.identity.caller', 'user': '$context.identity.user', 'requestTime': '$context.requestTime', 'httpMethod': '$context.httpMethod', 'resourcePath': '$context.resourcePath', 'status': '$context.status', 'protocol': '$context.protocol', 'responseLength': '$context.responseLength' }) } )

WAF association

WAF关联

waf = boto3.client('wafv2') web_acl = waf.create_web_acl( Name='api-security-acl', Scope='REGIONAL', DefaultAction={'Allow': {}}, Rules=[ { 'Name': 'AWS-AWSManagedRulesSQLiRuleSet', 'Priority': 1, 'Statement': { 'ManagedRuleGroupStatement': { 'VendorName': 'AWS', 'Name': 'AWSManagedRulesSQLiRuleSet' } }, 'OverrideAction': {'None': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'SQLiRuleSet' } }, { 'Name': 'RateLimit', 'Priority': 2, 'Statement': { 'RateBasedStatement': { 'Limit': 2000, 'AggregateKeyType': 'IP' } }, 'Action': {'Block': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'RateLimitRule' } }, ], VisibilityConfig={ 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'ApiSecurityACL' } )

undefined

waf = boto3.client('wafv2') web_acl = waf.create_web_acl( Name='api-security-acl', Scope='REGIONAL', DefaultAction={'Allow': {}}, Rules=[ { 'Name': 'AWS-AWSManagedRulesSQLiRuleSet', 'Priority': 1, 'Statement': { 'ManagedRuleGroupStatement': { 'VendorName': 'AWS', 'Name': 'AWSManagedRulesSQLiRuleSet' } }, 'OverrideAction': {'None': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'SQLiRuleSet' } }, { 'Name': 'RateLimit', 'Priority': 2, 'Statement': { 'RateBasedStatement': { 'Limit': 2000, 'AggregateKeyType': 'IP' } }, 'Action': {'Block': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'RateLimitRule' } }, ], VisibilityConfig={ 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'ApiSecurityACL' } )

undefined

Step 3: Request Validation with OpenAPI Schema

步骤3：基于OpenAPI Schema的请求验证

yaml

undefined

yaml

undefined

Kong OAS Validation Plugin configuration

Kong OAS验证插件配置

plugins:

name: oas-validation config: api_spec: | openapi: "3.0.3" info: title: Secure API version: "1.0" paths: /api/v1/users: post: requestBody: required: true content: application/json: schema: type: object required: [name, email] properties: name: type: string maxLength: 100 pattern: "^[a-zA-Z ]+$" email: type: string format: email maxLength: 255 additionalProperties: false # Block mass assignment responses: '201': description: User created validate_request_body: true validate_request_header_params: true validate_request_query_params: true validate_request_uri_params: true verbose_response: false # Do not expose schema details in errors

undefined

plugins:

name: oas-validation config: api_spec: | openapi: "3.0.3" info: title: Secure API version: "1.0" paths: /api/v1/users: post: requestBody: required: true content: application/json: schema: type: object required: [name, email] properties: name: type: string maxLength: 100 pattern: "^[a-zA-Z ]+$" email: type: string format: email maxLength: 255 additionalProperties: false # 阻止批量赋值 responses: '201': description: User created validate_request_body: true validate_request_header_params: true validate_request_query_params: true validate_request_uri_params: true verbose_response: false # 错误信息中不暴露Schema细节

undefined

Step 4: Mutual TLS Configuration

步骤4：双向TLS（mTLS）配置

bash

undefined

bash

undefined

Generate CA and client certificates for mTLS

生成用于mTLS的CA和客户端证书

1. Create CA

1. 创建CA

openssl genrsa -out ca.key 4096 openssl req -new -x509 -key ca.key -out ca.crt -days 365
-subj "/CN=API Gateway CA/O=Example Corp"

2. Create client certificate

2. 创建客户端证书

openssl genrsa -out client.key 2048 openssl req -new -key client.key -out client.csr
-subj "/CN=api-client/O=Example Corp" openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key
-CAcreateserial -out client.crt -days 365

Kong mTLS configuration

Kong mTLS配置

Upload CA certificate to Kong

将CA证书上传至Kong

curl -X POST http://kong-admin:8001/ca_certificates
-F "cert=@ca.crt"

Enable mTLS plugin

启用mTLS插件

curl -X POST http://kong-admin:8001/services/user-service/plugins
--data "name=mtls-auth"
--data "config.ca_certificates[]=$(cat ca_cert_id)"
--data "config.revocation_check_mode=SKIP"
--data "config.authenticated_group_by=CN"

undefined

curl -X POST http://kong-admin:8001/services/user-service/plugins
--data "name=mtls-auth"
--data "config.ca_certificates[]=$(cat ca_cert_id)"
--data "config.revocation_check_mode=SKIP"
--data "config.authenticated_group_by=CN"

undefined

Step 5: Logging and Monitoring Configuration

步骤5：日志与监控配置

python

undefined

python

undefined

CloudWatch monitoring for API security events

针对API安全事件的CloudWatch监控

import boto3

cloudwatch = boto3.client('cloudwatch') logs = boto3.client('logs')

import boto3

cloudwatch = boto3.client('cloudwatch') logs = boto3.client('logs')

Create metric filters for security events

创建安全事件的指标过滤器

security_filters = [ { 'name': 'UnauthorizedAccess', 'pattern': '{ $.status = 401 || $.status = 403 }', 'metric': 'UnauthorizedAccessCount' }, { 'name': 'RateLimitHits', 'pattern': '{ $.status = 429 }', 'metric': 'RateLimitHitCount' }, { 'name': 'ServerErrors', 'pattern': '{ $.status >= 500 }', 'metric': 'ServerErrorCount' }, { 'name': 'LargeResponses', 'pattern': '{ $.responseLength > 1000000 }', 'metric': 'LargeResponseCount' }, ]

for sf in security_filters: logs.put_metric_filter( logGroupName='api-access-logs', filterName=sf['name'], filterPattern=sf['pattern'], metricTransformations=[{ 'metricName': sf['metric'], 'metricNamespace': 'APISecurityMetrics', 'metricValue': '1', 'defaultValue': 0 }] )

security_filters = [ { 'name': 'UnauthorizedAccess', 'pattern': '{ $.status = 401 || $.status = 403 }', 'metric': 'UnauthorizedAccessCount' }, { 'name': 'RateLimitHits', 'pattern': '{ $.status = 429 }', 'metric': 'RateLimitHitCount' }, { 'name': 'ServerErrors', 'pattern': '{ $.status >= 500 }', 'metric': 'ServerErrorCount' }, { 'name': 'LargeResponses', 'pattern': '{ $.responseLength > 1000000 }', 'metric': 'LargeResponseCount' }, ]

for sf in security_filters: logs.put_metric_filter( logGroupName='api-access-logs', filterName=sf['name'], filterPattern=sf['pattern'], metricTransformations=[{ 'metricName': sf['metric'], 'metricNamespace': 'APISecurityMetrics', 'metricValue': '1', 'defaultValue': 0 }] )

Create alarm for unusual 401/403 spike

为异常401/403峰值创建告警

cloudwatch.put_metric_alarm( AlarmName='API-UnauthorizedAccessSpike', MetricName='UnauthorizedAccessCount', Namespace='APISecurityMetrics', Statistic='Sum', Period=300, # 5 minutes EvaluationPeriods=1, Threshold=100, ComparisonOperator='GreaterThanThreshold', AlarmActions=['arn:aws:sns:us-east-1:123456789:security-alerts'], AlarmDescription='More than 100 unauthorized access attempts in 5 minutes' )

undefined

cloudwatch.put_metric_alarm( AlarmName='API-UnauthorizedAccessSpike', MetricName='UnauthorizedAccessCount', Namespace='APISecurityMetrics', Statistic='Sum', Period=300, # 5分钟 EvaluationPeriods=1, Threshold=100, ComparisonOperator='GreaterThanThreshold', AlarmActions=['arn:aws:sns:us-east-1:123456789:security-alerts'], AlarmDescription='5分钟内出现超过100次未授权访问尝试' )

undefined

Key Concepts

核心概念

Term	Definition
API Gateway	Centralized entry point for all API traffic that enforces authentication, authorization, rate limiting, and request validation before routing to backend services
Rate Limiting	Controlling the number of API requests per client within a time window to prevent abuse and ensure fair resource allocation
Request Validation	Verifying that incoming API requests conform to the expected schema (data types, required fields, value ranges) before forwarding to backend services
Mutual TLS (mTLS)	Two-way TLS authentication where both the client and server present certificates, providing strong identity verification for API-to-API communication
WAF Integration	Web Application Firewall rules applied at the API gateway to block common attack patterns (SQLi, XSS, path traversal)
OAuth2/OIDC	Token-based authentication protocols where the gateway validates JWT tokens against an identity provider before allowing access

术语	定义
API Gateway	所有API流量的集中入口点，在路由到后端服务前强制实施认证、授权、速率限制与请求验证
Rate Limiting	控制客户端在指定时间窗口内的API请求次数，防止滥用并确保资源公平分配
Request Validation	在转发至后端服务前，验证传入的API请求是否符合预期Schema（数据类型、必填字段、值范围）
Mutual TLS (mTLS)	双向TLS认证，客户端与服务器均需提供证书，为API间通信提供强身份验证
WAF Integration	在API网关应用Web应用防火墙规则，阻止常见攻击模式（SQL注入、XSS、路径遍历）
OAuth2/OIDC	基于令牌的认证协议，网关在允许访问前会向身份提供商验证JWT令牌

Tools & Systems

工具与系统

Kong Gateway: Open-source API gateway with extensive plugin ecosystem for security, rate limiting, and authentication
AWS API Gateway: Managed API gateway service with built-in throttling, WAF integration, and Lambda authorizers
Azure API Management: Enterprise API gateway with policy-based security, developer portal, and Azure AD integration
Apigee (Google Cloud): API management platform with threat protection, quota management, and API analytics
Envoy Proxy: High-performance proxy used as API gateway in service mesh architectures with extensive filter chain

Kong Gateway: 开源API网关，拥有丰富的安全、速率限制及认证插件生态
AWS API Gateway: 托管式API网关服务，内置流量控制、WAF集成及Lambda授权器
Azure API Management: 企业级API网关，支持基于策略的安全、开发者门户及Azure AD集成
Apigee (Google Cloud): API管理平台，具备威胁防护、配额管理及API分析功能
Envoy Proxy: 高性能代理，在服务网格架构中用作API网关，拥有丰富的过滤器链

Common Scenarios

常见场景

Scenario: Securing a Microservice API with Kong Gateway

场景：使用Kong网关保护微服务API

Context: A company is migrating from a monolithic API to microservices. Each microservice has its own REST API. The security team needs to implement centralized authentication, rate limiting, and request validation without modifying each service.

Approach:

Deploy Kong Gateway as the single entry point, routing traffic to 8 backend microservices
Configure JWT validation plugin to verify tokens against the company's Keycloak IdP
Apply rate limiting: 60 requests/minute for regular users, 300/minute for premium users, identified by JWT claims
Enable OAS validation plugin to reject requests that do not match the OpenAPI spec (blocks mass assignment and injection)
Configure mTLS for service-to-service communication behind the gateway
Set up response transformer to remove Server and X-Powered-By headers and add security headers
Integrate with AWS WAF for SQL injection and XSS protection rules
Configure access logging to CloudWatch with security metric filters and alerting

Pitfalls:

Relying solely on the gateway for authorization when backend services also need to verify permissions
Not configuring rate limiting per authenticated user (per-IP only allows attackers to bypass with IP rotation)
Using verbose error responses from the gateway that reveal internal service architecture
Not testing the gateway configuration with security tools after deployment
Missing mutual TLS between the gateway and backend services, allowing direct backend access

背景：某公司正从单体API迁移至微服务架构，每个微服务都有独立的REST API。安全团队需要在不修改每个服务的前提下，实现集中式认证、速率限制与请求验证。

实施方法：

部署Kong网关作为唯一入口，将流量路由至8个后端微服务
配置JWT验证插件，针对公司的Keycloak IdP验证令牌
应用速率限制：普通用户每分钟60次请求，高级用户每分钟300次请求，通过JWT声明识别用户类型
启用OAS验证插件，拒绝不符合OpenAPI规范的请求（阻止批量赋值与注入攻击）
为网关后的服务间通信配置mTLS
设置响应转换器，移除Server与X-Powered-By头信息并添加安全头
与AWS WAF集成，启用SQL注入与XSS防护规则
配置访问日志至CloudWatch，设置安全指标过滤器与告警

常见陷阱：

仅依赖网关进行授权，而后端服务也需验证权限
未针对已认证用户配置速率限制（仅按IP限制会让攻击者通过IP轮换绕过）
网关返回详细错误响应，暴露内部服务架构
部署后未使用安全工具测试网关配置
网关与后端服务间未配置双向TLS，允许直接访问后端服务

Output Format

输出格式

undefined

undefined

API Gateway Security Configuration Report

API网关安全配置报告

Gateway: Kong 3.5 (Kubernetes deployment) Backend Services: 8 microservices Date: 2024-12-15

网关: Kong 3.5（Kubernetes部署） 后端服务: 8个微服务日期: 2024-12-15

Security Controls Implemented

已实施的安全控制

Control	Plugin/Feature	Configuration
Authentication	JWT Plugin	Cognito IdP, 1-hour max TTL
Rate Limiting	Rate Limiting Plugin	60 req/min (user), Redis-backed
Request Validation	OAS Validation	Strict mode, no additional properties
TLS	Kong TLS	TLS 1.3 only, HSTS enabled
mTLS	mTLS Auth Plugin	Client cert required for admin APIs
WAF	AWS WAF	SQLi, XSS, rate-based rules
Headers	Response Transformer	Server header removed, security headers added
Logging	HTTP Log Plugin	CloudWatch, security metric filters

控制项	插件/功能	配置
认证	JWT插件	Cognito IdP，最长1小时令牌有效期
速率限制	速率限制插件	每分钟60次请求（按用户），基于Redis存储
请求验证	OAS验证	严格模式，不允许额外属性
TLS	Kong TLS	仅启用TLS 1.3，开启HSTS
mTLS	mTLS认证插件	管理API需客户端证书
WAF	AWS WAF	SQL注入、XSS、基于速率的规则
头信息	响应转换器	移除Server头，添加安全头
日志	HTTP日志插件	CloudWatch，安全指标过滤器

Verification Results

验证结果

JWT validation: Expired/invalid tokens correctly rejected (tested 50 payloads)
Rate limiting: Enforced at 60 req/min, 429 returned with Retry-After header
Request validation: Malformed requests rejected with 400 (tested 30 invalid payloads)
mTLS: Requests without client certificate rejected with 401
WAF: SQL injection payloads blocked (tested top 100 SQLi patterns)

undefined

JWT验证：过期/无效令牌被正确拒绝（测试50个负载）
速率限制：严格执行每分钟60次请求，返回429状态码及Retry-After头
请求验证：格式错误的请求被拒绝（返回400，测试30个无效负载）
mTLS：无客户端证书的请求被拒绝（返回401）
WAF：SQL注入负载被拦截（测试Top 100 SQLi模式）

undefined

implementing-api-gateway-security-controls

Original

Translation

Implementing API Gateway Security Controls

API网关安全控制实现

When to Use

适用场景

Prerequisites

前置条件

Workflow

实施流程

Step 1: Kong Gateway Security Configuration

步骤1：Kong网关安全配置

kong.yml - Declarative Kong configuration with security plugins

kong.yml - 包含安全插件的Kong声明式配置

1. Authentication: JWT validation

2. Rate Limiting

3. Request Size Limiting

4. IP Restriction (admin endpoints)

5. Bot Detection

6. CORS Configuration

7. Response Transformer - Remove sensitive headers

1. 认证：JWT验证

2. 速率限制

3. 请求大小限制

4. IP限制（管理端点）

5. 机器人检测

6. CORS配置

7. 响应转换器 - 移除敏感头信息

Step 2: AWS API Gateway Security Configuration

步骤2：AWS API Gateway安全配置

Create API with mutual TLS

创建支持双向TLS的API

Configure authorizer (JWT with Cognito)

配置授权器（基于Cognito的JWT）

Create route with authorizer

创建带授权器的路由

Configure throttling

配置流量控制

WAF association

WAF关联

Step 3: Request Validation with OpenAPI Schema

步骤3：基于OpenAPI Schema的请求验证

Kong OAS Validation Plugin configuration

Kong OAS验证插件配置

Step 4: Mutual TLS Configuration

步骤4：双向TLS（mTLS）配置

Generate CA and client certificates for mTLS

生成用于mTLS的CA和客户端证书

1. Create CA

1. 创建CA

2. Create client certificate

2. 创建客户端证书

Kong mTLS configuration

Kong mTLS配置

Upload CA certificate to Kong

将CA证书上传至Kong

Enable mTLS plugin

启用mTLS插件

Step 5: Logging and Monitoring Configuration

步骤5：日志与监控配置

CloudWatch monitoring for API security events

针对API安全事件的CloudWatch监控

Create metric filters for security events

创建安全事件的指标过滤器

Create alarm for unusual 401/403 spike

为异常401/403峰值创建告警

Key Concepts

核心概念

Tools & Systems

工具与系统

Common Scenarios

常见场景

Scenario: Securing a Microservice API with Kong Gateway

场景：使用Kong网关保护微服务API

Output Format

输出格式

API Gateway Security Configuration Report

API网关安全配置报告

Security Controls Implemented