The title promises four attacks against the author’s own AWS API, followed by fixes and a documented account. But without the actual test cases, evidence, and remediation details, it would be misleading to invent what was attacked or what worked. A useful account must show, for each test, the authorization boundary examined, the observed result, the real fix, and how that fix was verified.
What the four tests need to establish
“My own API” signals authorized testing, but it does not identify the API architecture, the endpoints tested, whether the environment was production, or whether any data or service was affected. Those details matter: a test against an isolated staging service has different risks from a test against a live API. A credible account should identify its scope and authorization before describing the attacks.
As an Amazon Associate I earn from qualifying purchases.
For each test, readers need enough evidence to distinguish a demonstrated vulnerability from a suspicious response or a hypothetical risk. A clear record includes:
- Capability and identity: who or what made the request, and what permissions that caller was meant to have.
- Target and input: the endpoint and request element changed, described without exposing sensitive data or enabling misuse.
- Expected boundary: which object, property, or function the caller should not have been able to access or use.
- Observed evidence: the response or side effect that showed whether the boundary held.
- Impact and scope: what data or action was at risk, and whether testing affected real users or production systems.
- Remediation and verification: what code, policy, or configuration changed, followed by evidence that the same check now fails safely for an unauthorized caller and still works for an authorized one.
Without those particulars, the number of attacks alone does not tell readers what was vulnerable or whether the repairs were effective.
#1 Best Overall
How to classify an API flaw without guessing
The OWASP API Security Top 10 for 2023 provides categories that can help explain verified findings; it cannot establish which attacks occurred in this account. Its relevant categories include:
- API1:2023, Broken Object Level Authorization: a caller can access another user’s object, such as by manipulating an identifier, when the API should enforce ownership or another access rule.
- API2:2023, Broken Authentication: identity verification or token handling fails in a way that permits an attacker to act as another identity.
- API3:2023, Broken Object Property Level Authorization: a caller can read or change object fields they are not entitled to access.
- API4:2023, Unrestricted Resource Consumption: a caller can consume excessive resources or trigger costly work without adequate safeguards.
- API5:2023, Broken Function Level Authorization: a caller can invoke a function reserved for a more privileged role.
These categories are not interchangeable. Authentication answers who is making a request; authorization decides what that identity may do. A valid login or token does not prove a caller is allowed to access a particular record, change a particular field, or invoke an administrative function. OWASP’s API1 guidance says, “Object level authorization checks should be considered in every function that accesses a data source using an ID from the user.” OWASP API Security Top 10 – 2023.
Each of the four tests should be assigned a category only when its endpoint, request, and observed behavior support that classification. The title alone does not show that any one of these five risks was found.
Recommended Free Tools
What AWS guidance can—and cannot—say about the fix
If the API actually used Amazon API Gateway, AWS recommends least-privilege IAM for API Gateway management, request logging through CloudWatch Logs or Amazon Data Firehose, CloudWatch alarms, and CloudTrail records of API Gateway actions. These controls support infrastructure security, monitoring, and auditability; they do not by themselves prove that the application checks a caller’s entitlement to each object or function. AWS cautions that “These best practices are general guidelines and don’t represent a complete security solution.” See Security best practices in Amazon API Gateway.
Rank #3
Keep management-plane permissions separate from client identity and application authorization. A narrowly scoped IAM policy for people or systems managing API Gateway is not a substitute for checking what an API client may do at runtime. The article’s account needs to identify the actual repair—such as a code, policy, or configuration change—and show how the relevant boundary was tested again. General AWS recommendations are context, not evidence that the author applied them.
What logs and perimeter controls contribute
OWASP logging guidance recommends recording failed authentication, denied access, and input-validation errors, using structured logs with enough context to investigate suspicious activity, protecting log integrity, and monitoring continuously. Logs can help detect attempts and reconstruct what happened, but only the author’s actual records can show what these four tests left behind or whether an alert fired. See OWASP API10:2019, Insufficient Logging & Monitoring.
If the architecture used Amazon API Gateway, AWS WAF may add a perimeter filter: AWS describes rules that can allow or block requests by IP address or country and inspect request components such as query strings, bodies, and HTTP methods. Those filters can help with unwanted traffic, but they cannot decide whether an authenticated caller is entitled to a particular user’s object or a privileged function. WAF is an optional layer, not a replacement for authorization checks. See the AWS Security Overview of Amazon API Gateway and the OWASP API Security Top 10 – 2023.
How to read a claim that the API was fixed
“Fixed” is meaningful only when connected to a specific finding and a check of the repaired boundary. For each claimed repair, look for the changed control, the unauthorized case that was retested, and a permitted case showing the fix did not simply disable legitimate access. If the account provides no request/response evidence, change description, or retest result, readers cannot independently assess the finding or its resolution.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
