API Gateway Tracing Enabled

01 Sign in to AWS Management Console.

02 Navigate to API Gateway dashboard at https://console.aws.amazon.com/apigateway/.

03 In the left navigation panel, select APIs to open the APIs listing page.

04 Choose the API that you want to examine then click on its name (link) to access the API details and configuration.

05 In the navigation panel, within the API submenu, click Stages to list the stages created for the selected API.

06 Under Stages, select the API stage that you want to examine.

07 Select Logs/Tracing tab from the dashboard top panel.

08 On the Logs/Tracing panel, within X-Ray Tracing section, check Enable X-Ray Tracing setting status. If Enable X-Ray Tracing setting checkbox is not checked, the selected Amazon API Gateway API stage does not have active tracing (i.e. X-Ray tracing) enabled.

09 Repeat steps no. 6 – 8 to verify the X-Ray tracing setting status for other API stages created for the selected API.

10 Repeat steps no. 4 – 8 to verify other AWS API Gateway APIs available within the current region.

11 Change the AWS region from the navigation bar and repeat the audit process for other regions.

01 Run get-rest-apis command (OSX/Linux/UNIX) using custom query filters to list the IDs of the APIs available in the selected AWS region:

aws apigateway get-rest-apis
	--region us-east-1
	--output table
	--query 'items[*].id'

02 The command output should return a table with the requested API IDs:

----------------
|  GetRestApis |
+--------------+
|  aabbccddee  |
|  abcdabcdab  |
|  aaabbbbccc  |
+--------------+

03 Run get-stages command (OSX/Linux/UNIX) using the ID of the API that you want to examine as identifier and custom query filters to get the name(s) of the API stage(s) created for the selected API:

aws apigateway get-stages
	--region us-east-1
	--rest-api-id aabbccddee
	--output table
	--query 'item[*].stageName'

04 The command output should return a table with the API stage name(s):

----------------
|   GetStages  |
+--------------+
|  Production  |
|  Staging     |
|  Testing     |
|  Development |
+--------------+

05 Execute again get-stages command (OSX/Linux/UNIX) using the name of the API stage that you want to examine as identifier, e.g. "Production", and custom query filters to obtain the configuration status for the active tracing feature:

aws apigateway get-stages
	--region us-east-1
	--rest-api-id aabbccddee
	--query 'item[?(stageName==`Production`)].tracingEnabled | []'

06 The command output should return the requested configuration information:

[
    false
]

07 Repeat step no. 5 and 6 to check the active tracing feature status for other API stages created for the selected API.

08 Repeat steps no. 3 – 7 to verify other AWS API Gateway APIs available in the selected region.

09 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 8 to perform the audit process for other regions.

01 Sign in to AWS Management Console.

02 Navigate to API Gateway dashboard at https://console.aws.amazon.com/apigateway/.

03 In the left navigation panel, select APIs.

04 Choose the API that you want to reconfigure, then click on its name (link) to access the API configuration.

05 In the navigation panel, in the API submenu, click Stages to list the stages created for the selected API.

06 Under Stages, select the API stage that you want to reconfigure in order to enable tracing (see Audit section part I to identify the right stage).

07 Select Logs/Tracing tab from the dashboard top panel.

08 On the API stage Logs/Tracing panel, under X-Ray Tracing, select Enable X-Ray Tracing setting checkbox.

09 Click Save Changes to apply the new configuration changes. Now that the active tracing feature is enabled, you can use the AWS X-Ray Management Console to view the traces and service maps.

10 Repeat steps no. 6 – 9 to enable X-Ray tracing for other API stages created for the selected API.

11 Repeat steps no. 4 – 10 to reconfigure other Amazon API Gateway APIs available within the current region.

12 Change the AWS region from the navigation bar and repeat the entire process for other regions.

01 Run update-stage command (OSX/Linux/UNIX) using the name of the API stage that you want to reconfigure as identifier (see Audit section part II to identify the right API stage) to enable X-Ray tracing for the selected Amazon API Gateway API stage. The following command example enables active tracing for an API stage named "Production", created for an API identified by the ID "aabbccddee":

aws apigateway update-stage
	--region us-east-1
	--rest-api-id aabbccddee
	--stage-name 'Production'
	--patch-operations op=replace,path=/tracingEnabled,value=true

02 The command output should return the command request metadata:

{
    "tracingEnabled": true,
    "stageName": "Production",
    "cacheClusterEnabled": false,
    "cacheClusterStatus": "NOT_AVAILABLE",
    "deploymentId": "abcabc",
    "lastUpdatedDate": 1537957517,
    "createdDate": 1537954386,
    "methodSettings": {}
}

03 Repeat step no. 1 and 2 to enable X-Ray tracing for other API stages created for the selected API.

04 Repeat steps no. 1 –3 to update the configuration of other Amazon API Gateway APIs available in the current region.

05 Change the AWS region by updating the --region command parameter value and repeat the entire remediation process for other regions.