API Gateway endpoint

No authorizer (IAM, Cognito, API key, or Lambda authorizer) is configured on the API. Anyone who discovers the API Gateway URL can query any trip by ID. Combined with the SQL injection above, an attacker could extract all trip data.

Possible Fix: Add at minimum an IAM authorizer or API key:

byTripIdResource.addMethod(HttpMethod.GET, integration, {
authorizationType: AuthorizationType.IAM,
// ... rest of config
});