Ensure that Content Encoding feature is enabled for your Amazon API Gateway APIs in order to facilitate API payload compression. Once Content Encoding is enabled, the API Gateway service allows compression of response bodies based on client's Accept-Encoding header. API payload compression is triggered when the response body size is greater than or equal to the threshold configured as the minimum compression size (in bytes). You can set this threshold to a non-negative integer between 0 and 10485760 (10M bytes). The compression types supported by Amazon API Gateway service are GZIP, DEFLATE and identity.
This rule can help you with the following compliance standards:
For further details on compliance standards supported by Conformity, see here.
This rule resolution is part of the Conformity Security & Compliance tool for AWS.
Amazon API Gateway allows your client to call your API with compressed payloads using one of the supported compression types. API Gateway service supports decompression of the request payload, however, you must configure your API to enable compression of the response payload. Enabling compression for your API payload will help you improve your API performance and reduce bandwidth utilization.
To determine if your Amazon API Gateway APIs have Content Encoding feature enabled, perform the following:
Remediation / Resolution
To enable Amazon API Gateway API payload compression using Content Encoding feature, perform the following actions:
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Risk level: Medium