feat(apigateway): Add exposed_internet property based on endpoint type

[jychp]

Type of change

• New feature (non-breaking change that adds functionality)

Summary

This PR clarifies the distinction between two security concepts for API Gateway REST APIs:

1. anonymous_access (existing): Policy-level access determined by PolicyUniverse analysis of the resource policy. Indicates whether the policy allows anonymous/public access.

2. exposed_internet (new): Network-level exposure based on endpoint configuration type:

   • EDGE → Internet exposed (default, via CloudFront)
   • REGIONAL → Internet exposed (direct regional access)
   • PRIVATE → NOT internet exposed (VPC-only via VPC Endpoints)

Problem solved: Previously, a PRIVATE API Gateway with an open resource policy would show anonymous_access=true, which is misleading because the API is not actually reachable from the internet. Now users can use exposed_internet to determine network reachability and combine both properties for accurate security assessment.

New properties on APIGatewayRestAPI:

Property	Type	Description
endpoint_type	String	The endpoint configuration type (EDGE, REGIONAL, or PRIVATE)
exposed_internet	Boolean	true for EDGE/REGIONAL endpoints, false for PRIVATE endpoints

Related issues or links

• Fixes Anonymous access vs Internet exposure #1452

How was this tested?

• Updated integration tests to verify both REGIONAL and PRIVATE endpoint types
• test-001 (REGIONAL): endpoint_type='REGIONAL', exposed_internet=true
• test-002 (PRIVATE): endpoint_type='PRIVATE', exposed_internet=false

Checklist

General

• I have read the contributing guidelines.
• The linter passes locally (make lint).
• I have added/updated tests that prove my fix is effective or my feature works.

Proof of functionality

• New or updated unit/integration tests.

If you are changing a node or relationship

• Updated the schema documentation.
• Updated the schema README.

Notes for reviewers

• The endpointConfiguration.types field is already returned by the AWS get_rest_apis API and was present in our test data, so no additional API calls are needed.
• The types field is a list for historical AWS API reasons but in practice contains only one element.
• This is a non-breaking change - existing queries using anonymous_access will continue to work.

[cubic-dev-ai]

2 issues found across 4 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="cartography/models/aws/apigateway/apigateway.py">

<violation number="1" location="cartography/models/aws/apigateway/apigateway.py:27">
P2: Consider adding an index for `endpoint_type` since it is a lookup-heavy field for filtering API Gateway exposure and isn’t auto-indexed.

(Based on your team's feedback about indexing security-relevant and lookup-heavy properties.) [FEEDBACK_USED]</violation>

<violation number="2" location="cartography/models/aws/apigateway/apigateway.py:28">
P2: Consider adding an index for `exposed_internet`; it’s a security-relevant filter that will be used in compliance queries and isn’t auto-indexed.

(Based on your team's feedback about indexing security-relevant and lookup-heavy properties.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[kunaals]

tyty this is awesome