implementing-api-gateway-security-controls

Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.

Ir para a instalação

Repositório: mukul975/Anthropic-Cybersecurity-Skills
Última atividade na origem: 2 de agosto de 2026 às 16:32
Idioma detectado do SKILL.md: inglês
Estrelas: 27.732
Forks: 3.366

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill implementing-api-gateway-security-controls

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

4 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

Ver todas deste repositório

Implementing API Gateway Security Controls

When to Use

Deploying a centralized authentication and authorization layer for microservice APIs

Implementing rate limiting, throttling, and quota management across all API endpoints

Configuring request/response validation against OpenAPI specifications at the gateway level

Setting up TLS termination, mutual TLS, and certificate management for API traffic

Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns

Do not use as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.

Prerequisites

API gateway platform selected and deployed (Kong, AWS API Gateway, Azure APIM, or Apigee)

OpenAPI/Swagger specifications for all backend APIs

TLS certificates for the gateway domain

Identity provider (IdP) configured for OAuth2/OIDC (Okta, Auth0, Azure AD)

Monitoring and logging infrastructure (CloudWatch, Datadog, ELK)

Backend service endpoints registered and reachable from the gateway

Workflow

Step 1: Kong Gateway Security Configuration

# kong.yml - Declarative Kong configuration with security plugins _format_version: "3.0" services: - name: user-service url: http://user-service:8080 routes: - name: user-api paths: - /api/v1/users methods: - GET - POST - PUT - PATCH - DELETE strip_path:

Implementing API Gateway Security Controls

When to Use

Deploying a centralized authentication and authorization layer for microservice APIs

Implementing rate limiting, throttling, and quota management across all API endpoints

Configuring request/response validation against OpenAPI specifications at the gateway level

Setting up TLS termination, mutual TLS, and certificate management for API traffic

Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns

Do not use as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.

Prerequisites

API gateway platform selected and deployed (Kong, AWS API Gateway, Azure APIM, or Apigee)

OpenAPI/Swagger specifications for all backend APIs

TLS certificates for the gateway domain

Identity provider (IdP) configured for OAuth2/OIDC (Okta, Auth0, Azure AD)

Monitoring and logging infrastructure (CloudWatch, Datadog, ELK)

Backend service endpoints registered and reachable from the gateway

Workflow

Step 1: Kong Gateway Security Configuration

import boto3 import json apigw = boto3.client('apigatewayv2') # Create API with mutual TLS api_response = apigw.create_api( Name='secure-api', ProtocolType='HTTP', DisableExecuteApiEndpoint=True, # Force custom domain ) api_id = api_response['ApiId'] # Configure authorizer (JWT with Cognito) authorizer = apigw.create_authorizer( ApiId=api_id, AuthorizerType='JWT', IdentitySource='$request.header.Authorization', Name='cognito-jwt-authorizer', JwtConfiguration={ 'Audience': ['your-app-client-id'], 'Issuer': 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxx' } ) # Create route with authorizer apigw.create_route( ApiId=api_id, RouteKey='GET /api/v1/users', AuthorizerId=authorizer['AuthorizerId'], AuthorizationType='JWT', ) # Configure throttling apigw.create_stage( ApiId=api_id, StageName='prod', DefaultRouteSettings={ 'ThrottlingBurstLimit': 100, 'ThrottlingRateLimit': 50.0, # 50 requests per second }, AccessLogSettings={ 'DestinationArn': 'arn:aws:logs:us-east-1:123456789:log-group:api-access-logs', 'Format': json.dumps({ 'requestId': '$context.requestId', 'ip': '$context.identity.sourceIp', 'caller': '$context.identity.caller', 'user': '$context.identity.user', 'requestTime': '$context.requestTime', 'httpMethod': '$context.httpMethod', 'resourcePath': '$context.resourcePath', 'status': '$context.status', 'protocol': '$context.protocol', 'responseLength': '$context.responseLength' }) } ) # WAF association waf = boto3.client('wafv2') web_acl = waf.create_web_acl( Name='api-security-acl', Scope='REGIONAL', DefaultAction={'Allow': {}}, Rules=[ { 'Name': 'AWS-AWSManagedRulesSQLiRuleSet', 'Priority': 1, 'Statement': { 'ManagedRuleGroupStatement': { 'VendorName': 'AWS', 'Name': 'AWSManagedRulesSQLiRuleSet' } }, 'OverrideAction': {'None': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'SQLiRuleSet' } }, { 'Name': 'RateLimit', 'Priority': 2, 'Statement': { 'RateBasedStatement': { 'Limit': 2000, 'AggregateKeyType': 'IP' } }, 'Action': {'Block': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'RateLimitRule' } }, ], VisibilityConfig={ 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'ApiSecurityACL' } )

name	implementing-api-gateway-security-controls
description	Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.
domain	cybersecurity
subdomain	api-security
tags	["api-security","api-gateway","kong","aws-api-gateway","rate-limiting","waf"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1552.001","T1078.004","T1530"]

name	implementing-api-gateway-security-controls
description	Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.
domain	cybersecurity
subdomain	api-security
tags	["api-security","api-gateway","kong","aws-api-gateway","rate-limiting","waf"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1552.001","T1078.004","T1530"]

Term	Definition
API Gateway	Centralized entry point for all API traffic that enforces authentication, authorization, rate limiting, and request validation before routing to backend services
Rate Limiting	Controlling the number of API requests per client within a time window to prevent abuse and ensure fair resource allocation
Request Validation	Verifying that incoming API requests conform to the expected schema (data types, required fields, value ranges) before forwarding to backend services
Mutual TLS (mTLS)	Two-way TLS authentication where both the client and server present certificates, providing strong identity verification for API-to-API communication
WAF Integration	Web Application Firewall rules applied at the API gateway to block common attack patterns (SQLi, XSS, path traversal)
OAuth2/OIDC	Token-based authentication protocols where the gateway validates JWT tokens against an identity provider before allowing access

implementing-api-gateway-security-controls

Opções de instalação

Revise os arquivos de origem