Following is a list of the examples in this guide:

• Enforcing observability for governance
  • Require AWS X-Ray tracing is enabled
  • Require access logging is enabled
  • Require execution logging is enabled
• Enforcing security for governance
  • Require that AWS WAF is enabled
  • Require a client certificate for backend integrations
  • Require a particular TLS version for a custom domain
  • Require mTLS is enabled for all custom domains
  • Require a particular type of authorizer
  • Require that a usage plan is associated with a resource
  • Require API key to access a resource
  • Require request validations, including specific headers
  • Require only specific VPCs in the private API endpoint resource policy
• Enforcing management control
  • Freeze API modifications based on a tag
  • Prevent custom domains in child accounts (enforce central API service account)
  • Prevent public APIs in accounts other than the central API/service account
  • Require all resources to have tags
  • Require error responses to have custom messages
  • Require API has documentation
  • Require response payload compression is enabled