implementing-api-gateway-security-controls

Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.

跳到安装

仓库: mukul975/Anthropic-Cybersecurity-Skills
最近来源活动: 2026年8月2日 16:32
检测到的 SKILL.md 语言: 英语
星标: 27,732
分支: 3,366

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill implementing-api-gateway-security-controls

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

4 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

查看这个仓库的全部 Skills

Implementing API Gateway Security Controls

When to Use

Deploying a centralized authentication and authorization layer for microservice APIs

Implementing rate limiting, throttling, and quota management across all API endpoints

Configuring request/response validation against OpenAPI specifications at the gateway level

Setting up TLS termination, mutual TLS, and certificate management for API traffic

Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns

Do not use as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.

Prerequisites

API gateway platform selected and deployed (Kong, AWS API Gateway, Azure APIM, or Apigee)

OpenAPI/Swagger specifications for all backend APIs

TLS certificates for the gateway domain

Identity provider (IdP) configured for OAuth2/OIDC (Okta, Auth0, Azure AD)

Monitoring and logging infrastructure (CloudWatch, Datadog, ELK)

Backend service endpoints registered and reachable from the gateway

Workflow

Step 1: Kong Gateway Security Configuration

# kong.yml - Declarative Kong configuration with security plugins _format_version: "3.0" services: - name: user-service url: http://user-service:8080 routes: - name: user-api paths: - /api/v1/users methods: - GET - POST - PUT - PATCH - DELETE strip_path:

Implementing API Gateway Security Controls

When to Use

Deploying a centralized authentication and authorization layer for microservice APIs

Implementing rate limiting, throttling, and quota management across all API endpoints

Configuring request/response validation against OpenAPI specifications at the gateway level

Setting up TLS termination, mutual TLS, and certificate management for API traffic

Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns

Do not use as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.

Prerequisites

API gateway platform selected and deployed (Kong, AWS API Gateway, Azure APIM, or Apigee)

OpenAPI/Swagger specifications for all backend APIs

TLS certificates for the gateway domain

Identity provider (IdP) configured for OAuth2/OIDC (Okta, Auth0, Azure AD)

Monitoring and logging infrastructure (CloudWatch, Datadog, ELK)

Backend service endpoints registered and reachable from the gateway

Workflow

Step 1: Kong Gateway Security Configuration

import boto3 import json apigw = boto3.client('apigatewayv2') # Create API with mutual TLS api_response = apigw.create_api( Name='secure-api', ProtocolType='HTTP', DisableExecuteApiEndpoint=True, # Force custom domain ) api_id = api_response['ApiId'] # Configure authorizer (JWT with Cognito) authorizer = apigw.create_authorizer( ApiId=api_id, AuthorizerType='JWT', IdentitySource='$request.header.Authorization', Name='cognito-jwt-authorizer', JwtConfiguration={ 'Audience': ['your-app-client-id'], 'Issuer': 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxx' } ) # Create route with authorizer apigw.create_route( ApiId=api_id, RouteKey='GET /api/v1/users', AuthorizerId=authorizer['AuthorizerId'], AuthorizationType='JWT', ) # Configure throttling apigw.create_stage( ApiId=api_id, StageName='prod', DefaultRouteSettings={ 'ThrottlingBurstLimit': 100, 'ThrottlingRateLimit': 50.0, # 50 requests per second }, AccessLogSettings={ 'DestinationArn': 'arn:aws:logs:us-east-1:123456789:log-group:api-access-logs', 'Format': json.dumps({ 'requestId': '$context.requestId', 'ip': '$context.identity.sourceIp', 'caller': '$context.identity.caller', 'user': '$context.identity.user', 'requestTime': '$context.requestTime', 'httpMethod': '$context.httpMethod', 'resourcePath': '$context.resourcePath', 'status': '$context.status', 'protocol': '$context.protocol', 'responseLength': '$context.responseLength' }) } ) # WAF association waf = boto3.client('wafv2') web_acl = waf.create_web_acl( Name='api-security-acl', Scope='REGIONAL', DefaultAction={'Allow': {}}, Rules=[ { 'Name': 'AWS-AWSManagedRulesSQLiRuleSet', 'Priority': 1, 'Statement': { 'ManagedRuleGroupStatement': { 'VendorName': 'AWS', 'Name': 'AWSManagedRulesSQLiRuleSet' } }, 'OverrideAction': {'None': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'SQLiRuleSet' } }, { 'Name': 'RateLimit', 'Priority': 2, 'Statement': { 'RateBasedStatement': { 'Limit': 2000, 'AggregateKeyType': 'IP' } }, 'Action': {'Block': {}}, 'VisibilityConfig': { 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'RateLimitRule' } }, ], VisibilityConfig={ 'SampledRequestsEnabled': True, 'CloudWatchMetricsEnabled': True, 'MetricName': 'ApiSecurityACL' } )

name	implementing-api-gateway-security-controls
description	Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.
domain	cybersecurity
subdomain	api-security
tags	["api-security","api-gateway","kong","aws-api-gateway","rate-limiting","waf"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1552.001","T1078.004","T1530"]

name	implementing-api-gateway-security-controls
description	Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.
domain	cybersecurity
subdomain	api-security
tags	["api-security","api-gateway","kong","aws-api-gateway","rate-limiting","waf"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1552.001","T1078.004","T1530"]

Term	Definition
API Gateway	Centralized entry point for all API traffic that enforces authentication, authorization, rate limiting, and request validation before routing to backend services
Rate Limiting	Controlling the number of API requests per client within a time window to prevent abuse and ensure fair resource allocation
Request Validation	Verifying that incoming API requests conform to the expected schema (data types, required fields, value ranges) before forwarding to backend services
Mutual TLS (mTLS)	Two-way TLS authentication where both the client and server present certificates, providing strong identity verification for API-to-API communication
WAF Integration	Web Application Firewall rules applied at the API gateway to block common attack patterns (SQLi, XSS, path traversal)
OAuth2/OIDC	Token-based authentication protocols where the gateway validates JWT tokens against an identity provider before allowing access

implementing-api-gateway-security-controls

安装方式

检查来源文件