---
schema_version: "1"
id: e1d5d21d4cfdf09f53ae0657d5031eddd0afc3976b1accb3d23d3f385d958ce6
title: Adding a Scanner for Amazon API Gateway
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/exchange/adding-amazon-gateway-scanner.md
canonical_url: https://docs.mulesoft.com/exchange/adding-amazon-gateway-scanner
source_site: docs.mulesoft.com
content_type: documentation
content_hash: ac789cc141ace7b18651f40642d6a94f741a0630bfa807cc79ad13b67c40d279
description: MuleSoft Documentation Site
latest: true
---
---
product: Exchange
---

# Adding a Scanner for Amazon API Gateway

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Add a scanner to discover, import, and sync APIs from Amazon API Gateway into Anypoint Exchange and
to discover and read policies from API configurations. Once imported, you can apply governance
rulesets and publish them to your developer portal.

The scanner discovers policies attached to supported Amazon API Gateway API, stage, route, and
integration configurations and shows discovered policies in the enhanced MuleSoft experience as
policies applied per imported API. Policies outside the supported scanner coverage aren’t currently
scanned.

## Before You Begin

Before adding the scanner, verify that you have these prerequisites:

For discovering and importing APIs:

- Exchange Administrator permission

- Knowledge about the Amazon Web Services region where the services are deployed.

- AWS access key ID

- AWS secret access key

Additional requirements for discovering and reading policies:

- IAM policy with read permissions for Amazon API Gateway:

  - `apigateway:GET`

  - `apigateway:GET*` actions on REST and HTTP API resources

- Resource scope:

  - `arn:aws:apigateway:{region}::/restapis/*`

  - `arn:aws:apigateway:{region}::/apis/*`

    For web application firewall (WAF) policies, the scanner also uses
    `software.amazon.awssdk:wafv2` and `software.amazon.awssdk:route53`.

Example custom IAM policy for read-only access:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["apigateway:GET"],
      "Resource": "*"
    }
  ]
}
```

## Policy Coverage for Amazon API Gateway

The scanner reads and extracts these policy areas from AWS API Gateway configurations:

<table><colgroup><col> <col></colgroup><thead><tr><th>Policy area</th><th>What the scanner reads</th></tr></thead><tbody><tr><td><p>Authentication and authorization</p></td><td><p>IAM signature enforcement (<code>aws-iam</code>), Cognito/custom authorizers (<code>cognito-authorizer</code>), and API key requirements (<code>api-key-required</code>).</p></td></tr><tr><td><p>Rate limiting and quotas</p></td><td><p>Usage plan throttles and quotas, stage and method throttles, and account-level default throttle settings.</p></td></tr><tr><td><p>Network and access control</p></td><td><p>Resource policies (including IP-filter conditions), mutual TLS settings, and CORS-related request filtering.</p></td></tr><tr><td><p>Application firewall and threat protection</p></td><td><p>WAF Web ACLs, WAF IP filtering rules, WAF size restrictions, and WAF bot control rules.</p></td></tr><tr><td><p>Traffic, resilience, and optimization</p></td><td><p>Canary settings, Route53 health-check associations, and API cache settings.</p></td></tr><tr><td><p>Request and response processing</p></td><td><p>Integration timeout settings, header mappings, VTL mapping templates, request validators, and integration type patterns (including Step Functions and mock integrations).</p></td></tr><tr><td><p>Observability</p></td><td><p>Access logging, X-Ray tracing, and CloudWatch metrics.</p></td></tr></tbody></table>

Policies that aren’t represented in this supported coverage list aren’t currently scanned by this
Amazon API Gateway scanner.

The scanner doesn’t currently read these policy areas:

<table><colgroup><col> <col></colgroup><thead><tr><th>Policy area not scanned</th><th>Reason</th></tr></thead><tbody><tr><td><p>JWT check (<code>jwt-check</code>)</p></td><td><p>JWT authorizers are tied to HTTP API v2 patterns and aren’t covered by this scanner’s current API model.</p></td></tr><tr><td><p>Attribute-based access control (<code>attribute-based-access-control</code>)</p></td><td><p>There isn’t a reliable API-to-policy linkage signal in the current scanner flow.</p></td></tr><tr><td><p>Tokenization (<code>tokenization</code>)</p></td><td><p>This is typically enforced in downstream services (for example, Lambda/KMS usage), not directly in API Gateway configuration.</p></td></tr><tr><td><p>PII protection (<code>pii-protection</code>)</p></td><td><p>This is typically implemented in downstream processing services, not as direct API Gateway policy configuration.</p></td></tr></tbody></table>

## Add a Scanner for Amazon API Gateway

1.  Verify that you are in the business group where you want to add the scanner.

2.  From the sidebar in Exchange, click **Scanners**.

3.  Enter a name for the scanner.

4.  From **Scanner Run Configuration**, complete these fields or options:

    <table><colgroup><col> <col></colgroup><thead><tr><th><strong>Field/Option</strong></th><th><strong>Value</strong></th></tr></thead><tbody><tr><td><p><strong>Run Schedule</strong></p></td><td><p>Select a frequency and local time.</p></td></tr><tr><td><p><strong>Sync Review</strong></p></td><td><p>Select an option: <strong>Auto-resolve</strong> or <strong>Ask to review</strong>.</p></td></tr></tbody></table>

5.  From **Connection Configuration**, complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th><strong>Field</strong></th><th><strong>Value</strong></th></tr></thead><tbody><tr><td><p><strong>Provider</strong></p></td><td><p>Select <strong>Amazon</strong>.</p></td></tr><tr><td><p><strong>Platform</strong></p></td><td><p>Select <strong>API Gateway</strong>.</p></td></tr><tr><td><p><strong>Service Type</strong></p></td><td><p><strong>REST APIs</strong> selected by default.</p></td></tr><tr><td><p><strong>Authentication Method</strong></p></td><td><p><strong>Access key</strong> selected by default.</p></td></tr><tr><td><p><strong>AWS Access Key ID</strong></p></td><td><p>Enter the access key ID.</p></td></tr><tr><td><p><strong>AWS Secret Access Key</strong></p></td><td><p>Enter the secret access key.</p></td></tr><tr><td><p><strong>AWS Region</strong></p></td><td><p>Select a region.</p></td></tr></tbody></table>

6.  Click **Test Connection**.

    If the connection fails, review the **Connection Configuration** settings. Update the settings,
    and then test the connection again.

7.  To send email notifications:

    1.  Select **Advanced Settings** and turn on **Send Email Notifications**.

    2.  Enter an email address.

8.  Click **Add Scanner**.

## See Also

- [AWS scanners](https://docs.mulesoft.com/exchange/aws-scanners)

- [Discovering and Cataloging External Assets with Scanners](https://docs.mulesoft.com/exchange/discovering-and-importing-external-agents)

- [Managing Scanners](https://docs.mulesoft.com/exchange/managing-scanners)