Api security

I'm trying to solve an api compliance problem. There are many externally facing api's in our organisation which are not following security standards. I want to build a automation to audit them and mark them according to compliance.
I want to identify these Api''s
1. Api's that do not have WAF( web application firewall) configured.
2. Api's that do not have correct authorizer configured.
3. Api's that use http.

I want to write some custom aws config rules(logic run in …

api api security application audit automation build compliance cybersecurity facing firewall identify mark organisation problem security security standards standards waf web web application web application firewall