📝 AWS API Gateway REST API Stage X-Ray Tracing is not enabled 🟢

• Contextual name: 📝 REST API Stage X-Ray Tracing is not enabled 🟢
• ID: /ce/ca/aws/apigateway/rest-api-stage-x-ray-tracing
• Located in: 📁 AWS API Gateway

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • PERFORMANCE

Similar Policies

• Internal
  • dec-x-82388e10

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-82388e10	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS API Gateway Stage
  • 🔌 AWS API Gateway Stage - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Enable X-Ray active tracing for API Gateway REST API stages to capture real-time metrics and trace the flow of user requests. This ensures enhanced monitoring and performance optimization across connected API Gateway and backend services.

Rationale

Enabling X-Ray Active tracing provides detailed visibility into API request performance, allowing rapid identification and resolution of bottlenecks or anomalies in the underlying infrastructure. With real-time metrics, teams can respond proactively to issues, reducing downtime risks and improving system performance. This traceability is especially critical for applications with complex dependencies and distributed architectures.

Impact

Enabling X-Ray Active tracing incurs costs associated with trace data processing and storage.

Audit

This policy marks an API Gateway Stage as INCOMPLIANT if the X-Ray Tracing Enabled field is set to No.

Remediation

Open File

Remediation

From Command Line

Enable X-Ray tracing

Use the following command to update the Stage settings and enable X-Ray tracing:

aws apigateway update-stage \
--rest-api-id {{rest-api-id}} \
--stage-name {{stage-name}} \
--patch-operations op=replace,path=/tracingEnabled,value=true

Test API calls

Perform a few API calls and verify that traces appear in the AWS X-Ray console. Ensure that the traces show accurate request flows and performance metrics.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 36i service level management mechanisms — to monitor, manage and align information security with business objectives;		2	2
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [APIGateway.3] API Gateway REST API stages should have AWS X-Ray tracing enabled		1	1
💼 Cloudaware Framework → 💼 Performance Tuning			3
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		47
💼 FedRAMP High Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)	2		8
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		46	48
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Low Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)	1		8
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)	2		8
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities			26
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources			26
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			83
💼 NIST CSF v2.0 → 💼 DE.CM-02: The physical environment is monitored to find potentially adverse events			8
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			59
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events			27
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations			10
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties			23
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities			24
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded			22
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked			24
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	45	47
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring	6		8