The following use case shows how to enforce observability for Amazon API Gateway governance using the following controls:

• Require AWS X-Ray tracing is enabled
• Require access logging is enabled
• Require execution logging is enabled

Require AWS X-Ray tracing is enabled

Resources

• Setting up AWS X-Ray with API Gateway REST APIs
• Amazon API Gateway active tracing support for AWS X-Ray
• Amazon API Gateway API Reference - CreateStage

Preventative controls

N/A. AWS Identity and Access Management (IAM) and service control policies (SCP) for API Gateway do not have conditions related to AWS X-Ray.

Proactive controls

AWS Config rule - https://docs.aws.amazon.com/config/latest/developerguide/api-gw-xray-enabled.html

Note: Proactive controls may block the first deployment for a new API using the AWS Management Console. The AWS Console does not allow you to specify the X-Ray settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referencing a deployment. Creating a stage using Infrastructure as Code (IaC) or the AWS CLI works as expected as the deployment ID is optional.

Detective controls

AWS Config rule - https://docs.aws.amazon.com/config/latest/developerguide/api-gw-xray-enabled.html

Require access logging is enabled

Resources

• Setting up CloudWatch logging for a REST API in API Gateway
• AccessLoggingDestination - Actions, resources, and condition keys for Amazon API Gateway Management
• AccessLoggingFormat - Actions, resources, and condition keys for Amazon API Gateway Management

Preventative controls

You can use a SCP that prevents any create/update actions on API Gateway stages that do not have an access logging destination or a log format specified. Use conditions apigateway:Resource/AccessLoggingDestination and apigateway:Request/AccessLoggingFormat. Optionally, a SCP can use these conditions for more fine-grained control over what needs to be logged and where logs should be delivered to. For example, the following policy prevents users from creating a new or updating an existing stage if it does not have an access logs destination specified:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Deny",
      "Action": [
        "apigateway:PATCH",
        "apigateway:POST",
        "apigateway:PUT"
      ],
      "Resource": [
        "arn:aws:apigateway:*::/restapis/*/stages/*"
      ],
      "Condition": {
        "StringLikeIfExists": {
          "apigateway:Request/AccessLoggingDestination": ""
        }
      }
    }
  ]
}

Note: Preventative controls would block the initial setup of a new stage using the AWS Management Console. The AWS Console does not allow you to specify the access logs settings for a new stage when it is created.

Detective controls

AWS Config custom rule using Guard, enabled for all AWS::ApiGateway::Stage resources:

rule apigw_access_logs_enabled_check when
    resourceType == "AWS::ApiGateway::Stage"
    {
        configuration.accessLogSettings.destinationArn is_string
    }

Require execution logging is enabled

Resources

• Setting up CloudWatch logging for a REST API in API Gateway

Preventative controls

N/A. IAM and SCPs for API Gateway do not have conditions related to the execution logs.

Proactive controls

Custom AWS CloudFormation Hook.

Note: Proactive controls may block the first deployment of a new API from the AWS Management Console. The AWS Console does not allow you to specify the execution logs settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referring to a deployment. Creating a stage using IaC or the AWS CLI works as expected as the deployment ID is optional.

Detective controls

AWS Config rule - https://docs.aws.amazon.com/config/latest/developerguide/api-gw-execution-logging-enabled.html