INVOKING MISCONFIGURED API GATEWAYS FROM ANY EXTERNAL AWS ACCOUNTS

Summary from the TLDR InfoSec newsletter

Private API Gateways in AWS are not internet accessible but are accessible to anyone in the AWS networks. Users who don't realize this can misconfigure the API Gateway with a Principal of ‘*' with the intention of allowing access from any VPC in their account, but are actually opening it to any VPC in AWS. This attack generally cannot be exploited without some initial access or knowledge of the API Gateway endpoint and REST API spec.