[Bug]: apigateway_restapi_authorizers_enabled.py does not consider authorizers configured at the method level about prowler

[n4ch04]

Hi @Fennerr,
It makes sense, since the check metadata explicitly specifies If no authorizer is enabled anyone can use the service. so authorization can be handled at API scope or method scope.
I think I'm gonna store the method configuration in the apigateway service, and then the check logic would be:

if rest_api.authorizer:
    report.status = "PASS"
elif all methods authorized:
   report.status = "PASS"
else:
   report.status = "FAIL"

If a single method is not authorized and there is no API authorizer configured it would generate a FAIL

What do you think?

[n4ch04]

Please @Fennerr test the proposed solution and let us know if it works

[Fennerr]

Hi @n4ch04 - this does seem like a good approach - the only thing I would add is maybe skipping authorization checks on OPTIONS calls. Im a bit busy today, but Ill give it a go tomorrow and report back

[n4ch04]

Ok, please check it and let us know, we can add the OPTIONS http method handling