Application programming interface (API) security
Systems and methods for enhancing API security by identifying anomalous activities in a cloud environment are provided. In one embodiment, the lack of awareness of an external API with respect to how calls to the external API may affect a cluster of a container orchestration platform is addressed. For instance, the views of the external and internal APIs may be combined to achieve better API security by correlating external API calls with undesirable behavior or other anomalies arising in the internal API. Responsive to identifying such undesirable behavior, information (e.g., a host, a source IP, a user, a specific payload) associated with the offending external API call may be added to a network security feature (e.g., a deny list, an IPS, or a WAF) utilized by the external API to facilitate performance of enhanced filtering of subsequent external API calls by the external API on behalf of the internal API.
1 . A non-transitory machine readable medium storing instructions, which when executed by one or more processing resources of a cluster of a container orchestration platform, cause the cluster to:
determine, by a master node of the cluster, an impact on the cluster resulting from one or more internal application programming interface (API) calls to an API server of the cluster, wherein the one or more internal API calls are associated with an external API call made to an API gateway;
determine the impact satisfies one or more criteria; and
after the determining the impact satisfies the one or more criteria, facilitate performance of enhanced filtering by the API gateway by providing feedback to the API gateway, wherein the feedback comprises inclusion of a source Internet Protocol (IP) address associated with the external API call on a deny list in which the deny list contains one or more IP addresses from which subsequent external API calls are to be blocked by the API gateway.
2 . The non-transitory machine readable medium of claim 1 , wherein the API gateway comprises an ingress controller associated with the container orchestration platform.
3 . The non-transitory machine readable medium of claim 1 , wherein the API gateway is associated with a cloud provider in which the container orchestration platform is running.
4 . The non-transitory machine readable medium of claim 3 , wherein the API gateway includes one or more of a web application firewall (WAF) deployment and an intrusion prevention system (IPS) deployment.
5 . A method comprising:
determining, by a master node of a cluster of a container orchestration platform, an impact on the cluster resulting from one or more internal application programming interface (API) calls to an API server of the cluster, wherein the one or more internal API calls are associated with an external API call made to an API gateway;
determining, by the master node, the impact satisfies one or more criteria; and
after the determining the impact satisfies the one or more criteria, facilitating, by the master node, performance of enhanced filtering by the API gateway by providing feedback to the API gateway, wherein the feedback comprises one or more of:
inclusion of a source Internet Protocol (IP) address associated with the external API call on a deny list in which the deny list contains one or more IP addresses from which subsequent external API calls are to be blocked by the API gateway;
inclusion of information regarding a host or a user associated with the external API call on the deny list in which the deny list identifies one or more hosts or users from which subsequent external API calls are to be blocked by the API gateway; or
inclusion of content from a payload associated with the external API call on the deny list in which the deny list contains content from one or more payloads that when received as part of subsequent external API calls are to be blocked by the API gateway.
6 . The method of claim 5 , wherein the API gateway comprises an ingress controller associated with the container orchestration platform.
7 . The method of claim 5 , wherein the API gateway is associated with a cloud provider in which the container orchestration platform is running.
8 . The method of claim 7 , wherein the API gateway includes one or more of a web application firewall (WAF) deployment and an intrusion prevention system (IPS) deployment.
9 . A system comprising:
one or more processing resources;
instructions that when executed by the one or more processing resources, cause the system to:
determining, by a master node of a cluster of a container orchestration platform, an impact on the cluster resulting from one or more internal application programming interface (API) calls to an API server of the cluster, wherein the one or more internal API calls are associated with an external API call made to an API gateway;
determining, by the master node, the impact satisfies one or more criteria; and
after the determining the impact satisfies the one or more criteria, facilitating, by the master node, performance of enhanced filtering by the API gateway by providing feedback to the API gateway, wherein the feedback comprises one or more of:
inclusion of a source Internet Protocol (IP) address associated with the external API call on a deny list in which the deny list contains one or more IP addresses from which subsequent external API calls are to be blocked by the API gateway;
inclusion of information regarding a host or a user associated with the external API call on the deny list in which the deny list identifies one or more hosts or users from which subsequent external API calls are to be blocked by the API gateway; or
inclusion of content from a payload associated with the external API call on the deny list in which the deny list contains content from one or more payloads that when received as part of subsequent external API calls are to be blocked by the API gateway.
10 . The system of claim 9 , wherein the API gateway comprises an ingress controller associated with the container orchestration platform.
11 . The system of claim 9 , wherein the API gateway is associated with a cloud provider in which the container orchestration platform is running.
12 . The system of claim 11 , wherein the API gateway includes one or more of a web application firewall (WAF) deployment and an intrusion prevention system (IPS) deployment.
13 . A non-transitory machine readable medium storing instructions, which when executed by one or more processing resources of a cluster of a container orchestration platform, cause the cluster to:
determine, by a master node of the cluster, an impact on the cluster resulting from one or more internal application programming interface (API) calls to an API server of the cluster, wherein the one or more internal API calls are associated with an external API call made to an API gateway;
determine the impact satisfies one or more criteria; and
after the determining the impact satisfies the one or more criteria, facilitate performance of enhanced filtering by the API gateway by providing feedback to the API gateway, wherein the feedback comprises inclusion of information regarding a host or a user associated with the external API call on a deny list in which the deny list identifies one or more hosts or users from which subsequent external API calls are to be blocked by the API gateway.
14 . The non-transitory machine readable medium of claim 13 , wherein the API gateway comprises an ingress controller associated with the container orchestration platform.
15 . The non-transitory machine readable medium of claim 13 , wherein the API gateway is associated with a cloud provider in which the container orchestration platform is running.
16 . The non-transitory machine readable medium of claim 15 , wherein the API gateway includes one or more of a web application firewall (WAF) deployment and an intrusion prevention system (IPS) deployment.
17 . A non-transitory machine readable medium storing instructions, which when executed by one or more processing resources of a cluster of a container orchestration platform, cause the cluster to:
determine, by a master node of the cluster, an impact on the cluster resulting from one or more internal application programming interface (API) calls to an API server of the cluster, wherein the one or more internal API calls are associated with an external API call made to an API gateway;
determine the impact satisfies one or more criteria; and
after the determining the impact satisfies the one or more criteria, facilitate performance of enhanced filtering by the API gateway by providing feedback to the API gateway, wherein the feedback comprises inclusion of content from a payload associated with the external API call on a deny list, wherein the deny list contains content from one or more payloads that when received as part of subsequent external API calls are to be blocked by the API gateway.
18 . The non-transitory machine readable medium of claim 17 , wherein the API gateway comprises an ingress controller associated with the container orchestration platform.
19 . The non-transitory machine readable medium of claim 17 , wherein the API gateway is associated with a cloud provider in which the container orchestration platform is running.
20 . The non-transitory machine readable medium of claim 19 , wherein the API gateway includes one or more of a web application firewall (WAF) deployment and an intrusion prevention system (IPS) deployment.