🛡️ AWS API Gateway REST API Detailed CloudWatch Metrics are not enabled🟢

• Contextual name: 🛡️ REST API Detailed CloudWatch Metrics are not enabled🟢
• ID: /ce/ca/aws/apigateway/rest-api-detailed-cloudwatch-metrics
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: RELIABILITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS API Gateway API
  • 🔌 AWS API Gateway Stage - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: APIs Detailed CloudWatch Metrics

Description

Open File

Description

This policy identifies REST API Gateways where none of the related Stages have Detailed CloudWatch Metrics enabled. Detailed metrics allow monitoring of API stage caching, latency, and error rates at a more granular level, facilitating the configuration of precise alarms.

Rationale

By default, API Gateway reports metrics at the stage level. Enabling Detailed CloudWatch Metrics provides additional metrics at the method level (e.g., GET /resource), including Latency, IntegrationLatency, 4XXError, and 5XXError. These granular metrics are critical for:

• Identifying specific performance bottlenecks
• Debugging issues at the individual method level
• Ensuring the reliability and operational health of API endpoints

Audit

This policy targets the REST APIs. An API Gateway API is flagged as INCOMPLIANT when at least one associated API Gateway Stage has the CloudWatch Detailed Metrics Enabled set to False or there is no API Gateway Stage associated with it.

Remediation

Open File

Remediation

Enable Detailed CloudWatch Metrics

From Console

1. Log in to the AWS Console.
2. Navigate to the API Gateway service.
3. In the navigation panel, select APIs to view all API Gateway APIs.
4. Click the API you want to reconfigure.
5. Select Stages from the API menu to access its stages.
6. Click the stage you want to modify and open the Logs/Tracing tab.
7. In the CloudWatch Settings section, enable Detailed CloudWatch Metrics and click Save Changes. Once enabled, each API method will start generating metrics such as API calls, Latency, Integration Latency, 4XX, and 5XX errors.
8. Repeat steps 6–7 for all stages of the selected API.
9. Repeat steps 4–8 for each API in the current AWS region.
10. Switch regions from the navigation bar and repeat the process for other regions.

From Command Line

1. Use the update-stage command to enable detailed CloudWatch metrics for a specific API stage. Each method in the stage will start generating metrics such as API calls, Latency, Integration Latency, 4XX, and 5XX errors:

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Well-Architected → 💼 REL06-BP02 Define and calculate metrics (Aggregation)			1		no data
💼 Cloudaware Framework → 💼 System Configuration			54		no data