fsi-foundation-openapi

Files (45)

• SKILL.md
• SKILL_ja.md
• cdk-nag-test.template.ts · assets/
• deploy-openapi-fapi-sample-keycloak-toppage.png · assets/images/
• open-api-Arch-Basic-Diag.png · assets/images/
• open-api-Arch-Basic-Flow.png · assets/images/
• open-api-Arch-FAPI-Authlete-Diag.png · assets/images/
• open-api-Arch-FAPI-Authlete-Flow.png · assets/images/
• open-api-Arch-FAPI-keycloak-Diag.png · assets/images/
• open-api-Arch-FAPI-keycloak-Flow.png · assets/images/
• open-api-Arch-Multi-region.png · assets/images/
• open-api-Arch-Pattern.png · assets/images/
• .gitignore · assets/sample-cdk/guest-openapi-base-sample/
• SECURITY_NOTICE.md · assets/sample-cdk/guest-openapi-base-sample/
• bleafsi-guest-openapi-base-sample.ts · assets/sample-cdk/guest-openapi-base-sample/bin/
• parameter.ts · assets/sample-cdk/guest-openapi-base-sample/bin/
• cdk.json · assets/sample-cdk/guest-openapi-base-sample/
• jest.config.js · assets/sample-cdk/guest-openapi-base-sample/
• hello.js · assets/sample-cdk/guest-openapi-base-sample/lambda/
• api-gw.ts · assets/sample-cdk/guest-openapi-base-sample/lib/
• bleafsi-openapi-base-sample-stack.ts · assets/sample-cdk/guest-openapi-base-sample/lib/
• cloudfront.ts · assets/sample-cdk/guest-openapi-base-sample/lib/
• cognito.ts · assets/sample-cdk/guest-openapi-base-sample/lib/
• waf-apigw.ts · assets/sample-cdk/guest-openapi-base-sample/lib/
• package.json · assets/sample-cdk/guest-openapi-base-sample/
• guest-openapi-sample.test.ts · assets/sample-cdk/guest-openapi-base-sample/test/
• get_token.sh · assets/sample-cdk/guest-openapi-base-sample/tool/
• tsconfig.json · assets/sample-cdk/guest-openapi-base-sample/
• SECURITY_NOTICE.md · assets/sample-cdk/guest-openapi-fapi-sample/
• bleafsi-guest-openapi-fapi-sample.ts · assets/sample-cdk/guest-openapi-fapi-sample/bin/
• parameter.ts · assets/sample-cdk/guest-openapi-fapi-sample/bin/
• cdk.json · assets/sample-cdk/guest-openapi-fapi-sample/
• Dockerfile · assets/sample-cdk/guest-openapi-fapi-sample/docker_and_certification/
• jest.config.js · assets/sample-cdk/guest-openapi-fapi-sample/
• bleafsi-guest-openapi-fapi-stack.ts · assets/sample-cdk/guest-openapi-fapi-sample/lib/primary/
• keycloak.ts · assets/sample-cdk/guest-openapi-fapi-sample/lib/shared/
• vpc.ts · assets/sample-cdk/guest-openapi-fapi-sample/lib/shared/
• package.json · assets/sample-cdk/guest-openapi-fapi-sample/
• bleafsi-guest-openapi-fapi-sample.test.ts · assets/sample-cdk/guest-openapi-fapi-sample/test/
• tsconfig.json · assets/sample-cdk/guest-openapi-fapi-sample/
• tsconfig.base.json · assets/
• architecture.md · references/
• cdk-nag.md · references/
• deployment.md · references/
• fisc-mapping.md · references/

SKILL.md (first lines)

# Financial Open API (オープン API)

## 1. Workload Overview

An **Open API** in this reference architecture follows the Japanese Bankers Association
(全銀協) definition: an **API accessible to third parties (external companies, etc.)**.
It lets a financial institution expose services to individuals and Fintech partners
through APIs whose scope is one of two permission classes:

- **Reference / inquiry APIs (参照・照会系)** — read-oriented, mainly for end users.
  Examples: stock-price and FX-rate inquiry, bank-balance inquiry, loyalty-point inquiry.
- **Update / execution APIs (更新・実行系)** — state-changing, mainly for external
  Fintech companies that require financial-grade access. Examples: securities and
  investment-trust trade instructions, funds transfer (振込・振替).

**Business drivers.** Open APIs are the technical foundation of open banking and Fintech
collaboration in Japan. They let banks safely publish account, market, and transaction
functionality to partners while keeping strong identity, authorization, and transport
security. This workload does **not** mandate a specific documentation format (OpenAPI
Specification / Swagger), FAPI conformance, or OAuth2/OpenID Connect — those are optional
depending on the API class. Two access styles are provided:

- **Basic API access** — full AWS managed services (Amazon Cognito for auth, Amazon API
  Gateway for API management) for the reference/inquiry class.
- **Financial-grade API (FAPI) access** — an authorization server plus mutual-TLS
  authentication and encryption for the update/execution class, intended for
  development/testing verification of FAPI 1.0 behavior.

## 2. Best Practices and Key Components

### Best Practices

- MUST: Authenticate reference/inquiry API access with an Amazon Cognito user pool fronted by Amazon API Gateway.
- MUST: Authenticate update/execution (financial-grade) API access with mutual TLS (mTLS, client certificate) combined with an authorization server.
- MUST: Encrypt all client-facing traffic with TLS across Amazon API Gateway, Amazon Cognito, and Amazon CloudFront; encrypt API-backend traffic on the consumer side.
- MUST: Encrypt data at rest for Amazon EBS and Amazon Aurora using AWS Key Management Service, and protect the encryption keys with KMS key policies.
- MUST: Apply AWS WAF to Amazon CloudFront and restrict CloudFront distribution by geography (allowlist) to reduce the attack surface.
- MUST: Grant only least-privilege IAM permissions and access resources through temporary credentials from IAM roles.
- MUST: Enable CloudTrail for the authorization server and the DBMS (Amazon Aurora), and capture VPC Flow Logs plus Amazon CloudWatch Logs.
- MUST: Build the workload as multi-region / multi-AZ and prefer highly available AWS managed services for resiliency.
- SHOULD: Use an external IdP so that identity/auth information does not need to be synchronized between regions in the multi-region DR configuration.
- SHOULD: For FAPI 1.0 Advanced, use `tls_client_auth` (client TLS) for client authentication rather than the Keycloak default `private_key_jwt`.
- SHOULD: When Amazon API Gateway is the resource server, implement a Lambda Authorizer to check client-certificate revocation and CRL, because API Gateway mTLS does neither.
- SHOULD: Track server/client certificate expiry and renew both before they lapse; register CloudFront certificates in us-east-1 and API Gateway certificates in ap-northeast-1 (ACM).
- SHOULD: Use a PS256 or ES256 signing key for FAPI ID tokens (Keycloak realms do not create these key pairs by default).
- MUST NOT: Ship the API backend or client/resource-server application as part of these samples — they are out of scope and must be implemented by the consumer.
- MAY: Use AWS Systems Manager to centrally manage EC2 instances, and AWS Inspector to scan authorization-server/backend container images and EC2 for vulnerabilities.
- WILL: The FAPI sample is intended for development/test verification of FAPI 1.0 behavior, not as a turnkey production authorization server.
- WILL: Route 53 distributes requests across regions; how requests are split or failed over depends on the API backend system's policy.
- MUST: Apply cdk-nag's AwsSolutionsChecks (via Aspects) to every CDK stack built from this skill, and gate CI (jest etc.) on zero unsuppressed AwsSolutions-* findings; suppress exceptions only with an explicit reason via NagSuppressions (see references/cdk-nag.md).

### Key Components

#### API Management (Basic)

- **Component Overview**: Creates, publishes, maintains, monitors, and secures the
  reference/inquiry REST API; fronted by a CDN for edge delivery and caching, with WAF
  managed-rule protection and a custom/alternate domain over TLS.
- **Assumed AWS Services**: Amazon API Gateway (REST API, regional custom domain,
  Cognito authorizer), Amazon CloudFront, AWS WAF (WAFv2), AWS Certificate Manager,
  Amazon Route 53, AWS Lambda (sample backend).

#### API Authentication — Basic (IdP)

- **Component Overview**: Web/mobile user authentication, authorization, and user
  management for the reference/inquiry API class; issues ID tokens consumed by the API
  Gateway Cognito authorizer.
- **Assumed AWS Services**: Amazon Cognito (user pool `apiUserPool`, user pool client
  `apiUserPoolClient`).

#### Authorization Server (FAPI)

- **Component Overview**: A FAPI 1.0-capable authorization server (Authorization Server)
  running on the VPC that issues and introspects tokens; supports FAPI 1.0 Baseline and
  Advanced profiles. Offered as either a 3rd-party product (Authlete) or OSS (Keycloak);
  only the OSS Keycloak pattern is provided as a deployable sample.
- **Assumed AWS Services**: Amazon ECS on AWS Fargate (Keycloak container from Amazon
  ECR), Network Load Balancer, Amazon Aurora MySQL / Amazon RDS, AWS Secrets Manager,
  Amazon EC2 (Authlete/authorization-server hosting pattern).

#### mTLS / Certificate Security (FAPI)

- **Component Overview**: Mutual-TLS transport security between client, authorization
  server, and resource server using CA / intermediate-CA / server / client certificates;
  the same client certificate is used toward both the authorization server and the
  resource server.
- **Assumed AWS Services**: AWS Certificate Manager, Amazon API Gateway (mTLS-enabled
  REST/HTTP API as resource server), AWS Lambda (Lambda Authorizer for CRL / revocation).

#### Network & Data Layer (FAPI)

- **Component Overview**: An isolated multi-AZ VPC (public / protected / isolated
  subnets) hosting the Fargate authorization server and encrypted Aurora database, with
  interface/gateway VPC endpoints and encrypted VPC Flow Logs.
- **Assumed AWS Services**: Amazon VPC (VPC endpoints for CloudWatch Logs, ECR, ECR
  Docker, S3), Amazon Aurora MySQL (encrypted), AWS KMS, Amazon S3 (flow-log bucket),
  network ACLs.

#### Monitoring & Governance

- **Component Overview**: Operational monitoring, service-health detection, audit
  logging, and IaC-based configuration/backup for the whole workload.
- **Assumed AWS Services**: Amazon CloudWatch (metrics, Logs, Container Insights), AWS
  Health Dashboard, AWS CloudTrail, AWS Cloud Development Kit (AWS CDK), Amazon Aurora
  automated backups.

## 3. FISC Compliance Summary

The FISC mapping documents how this workload addresses the **FISC Security Guidelines
(安全対策基準), 実務基準 (Practice Standards), 11th edition**. Coverage is split across the
**governance-base template** (共通統制環境) and the **Open API workload template**, and each
row also lists example additional measures for the consumer. Only BLEA-for-FSI measures are
recorded; total system safety still requires the user's application implementation plus
operational/development-process controls.

Key regulatory considerations covered by the workload template:

- **Access control & authentication** (実1, 実2, 実9, 実26): Cognito for reference APIs;
  mTLS client-certificate + authorization-server auth for update/execution APIs.

From aws-samples/sample-fsi-reference-architecture-jp, MIT-0.

More from aws-samples/sample-fsi-reference-architecture-jp