API Gateway method has no authorizer

What it means

A method is configured with `AuthorizationType: NONE`.

Why it matters

Anyone who finds the URL can call it, and API Gateway URLs are not secret — they appear in browser network tabs, mobile app bundles and CloudFormation outputs. If the method reads or writes anything per-user, the only thing standing between an attacker and the data is that they have not guessed the id yet.

How to fix it

Attach a Cognito user pools authorizer or a Lambda authorizer. If a route is genuinely public, say so explicitly in code review rather than leaving it as the default.

See it fail

This stack trips AwsSolutions-APIG4 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.

Other rules