HIPAA Security - Implement api-gw-cache-enabled-and-encrypted config rule

[dontirun]

Summary

As a developer

I would like to implement the api-gw-cache-enabled-and-encrypted config rule

So that I can check if qualified resources in my CDK app conforms to the following HIPAA Security control(s): 164.312(a)(2)(iv), 164.312(e)(2)(ii)

Details

ruleId: HIPAA.Security-APIGWCacheEnabledAndEncrypted

info:  The API Gateway stage does not have caching enabled and encrypted for all methods - (Control IDs: 164.312(a)(2)(iv), 164.312(e)(2)(ii))

Given Reason: To help protect data at rest, ensure encryption is enabled for your API Gateway stage�s cache. Because sensitive data can be captured for the API method, enable encryption at rest to help protect that data.

Acceptance Criteria

If the rule can be implemented

Given a CDK app with a non-compliant resource

• When HIPAA Security Pack is enabled
• Then the CDK stack does not deploy and the user receives an ERROR with relevant Control ID information about the non compliant resource

Given a CDK app with a compliant resource

• When HIPAA Security Pack is enabled
• Then the CDK stack deploys and the user does not receive an ERROR about the compliant resource

Given the cdk-nag RULES file

• When the HIPAA.Security-APIGWCacheEnabledAndEncrypted rule is added to the rule pack
• Then the HIPAA Security Errors section is updated with the rule information

If the rule cannot be implemented

Given the cdk-nag RULES file

• When the api-gw-cache-enabled-and-encrypted check is not added to the rule pack
• Then the HIPAA Security Excluded Rules section is updated with the check information