Creating APIs without authentication unnecessarily increases the attack surface on the target infrastructure.
Unless another authentication method is used, attackers have the opportunity to attempt attacks against the underlying API.
This means attacks
both on the functionality provided by the API and its infrastructure.
There is a risk if you answered yes to this question.
In general, prefer limiting API access to a specific set of people or entities.
AWS provides multiple methods to do so:
AWS_IAM, to use standard AWS IAM roles and policies. COGNITO_USER_POOLS, to use customizable OpenID Connect (OIDC) identity providers (IdP). CUSTOM, to use an AWS-independant OIDC provider, glued to the infrastructure with a Lambda authorizer. A public API that doesn’t have access control implemented:
resource "aws_api_gateway_method" "noncompliantapi" {
authorization = "NONE" # Sensitive
http_method = "GET"
}
An API that implements AWS IAM permissions:
resource "aws_api_gateway_method" "compliantapi" {
authorization = "AWS_IAM"
http_method = "GET"
}