[{"data":1,"prerenderedAt":99},["ShallowReactive",2],{"content-guides-api-gateway-governance-observability":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":8,"contributorPaths":9,"menuType":11,"contentName":12,"slug":13,"readingTime":14,"menu":15,"nextDocItem":71,"previousDocItem":62},"\u003Cp>The following use case shows how to enforce observability for Amazon API Gateway governance using the following controls: \u003C\u002Fp>\n\u003Cul>\n\u003Cli>Require AWS X-Ray tracing is enabled\u003C\u002Fli>\n\u003Cli>Require access logging is enabled\u003C\u002Fli>\n\u003Cli>Require execution logging is enabled\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Require AWS X-Ray tracing is enabled\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-enabling-xray.html\">Setting up AWS X-Ray with API Gateway REST APIs\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fxray\u002Flatest\u002Fdevguide\u002Fxray-services-apigateway.html\">Amazon API Gateway active tracing support for AWS X-Ray\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateStage.html#apigw-CreateStage-request-tracingEnabled\">Amazon API Gateway API Reference - CreateStage\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. AWS Identity and Access Management (IAM) and service control policies (SCP) for API Gateway do not have conditions related to AWS X-Ray.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Proactive controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS Config rule - \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-xray-enabled.html\">https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-xray-enabled.html\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Cem>Note: Proactive controls may block the first deployment for a new API using the AWS Management Console. The AWS Console does not allow you to specify the X-Ray settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referencing a deployment. Creating a stage using Infrastructure as Code (IaC) or the AWS CLI works as expected as the deployment ID is optional.\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS Config rule - \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-xray-enabled.html\">https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-xray-enabled.html\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch4>Require access logging is enabled\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fset-up-logging.html\">Setting up CloudWatch logging for a REST API in API Gateway\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html#amazonapigatewaymanagement-apigateway_Resource_AccessLoggingDestination\">AccessLoggingDestination - Actions, resources, and condition keys for Amazon API Gateway Management\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html#amazonapigatewaymanagement-apigateway_Request_AccessLoggingFormat\">AccessLoggingFormat - Actions, resources, and condition keys for Amazon API Gateway Management\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>You can use a SCP that prevents any create\u002Fupdate actions on API Gateway stages that do not have an access logging destination or a log format specified. Use conditions \u003Ccode>apigateway:Resource\u002FAccessLoggingDestination\u003C\u002Fcode> and  \u003Ccode>apigateway:Request\u002FAccessLoggingFormat\u003C\u002Fcode>. Optionally, a SCP can use these conditions for more fine-grained control over what needs to be logged and where logs should be delivered to. \nFor example, the following policy prevents users from creating a new or updating an existing stage if it does not have an access logs destination specified:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Sid": "Statement1",\n      "Effect": "Deny",\n      "Action": [\n        "apigateway:PATCH",\n        "apigateway:POST",\n        "apigateway:PUT"\n      ],\n      "Resource": [\n        "arn:aws:apigateway:*::\u002Frestapis\u002F*\u002Fstages\u002F*"\n      ],\n      "Condition": {\n        "StringLikeIfExists": {\n          "apigateway:Request\u002FAccessLoggingDestination": ""\n        }\n      }\n    }\n  ]\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>\u003Cem>Note: Preventative controls would block the initial setup of a new stage using the AWS Management Console. The AWS Console does not allow you to specify the access logs settings for a new stage when it is created.\u003C\u002Fem> \u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS Config custom rule \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fevaluate-config_develop-rules_cfn-guard.html\">using Guard\u003C\u002Fa>, enabled for all \u003Ccode>AWS::ApiGateway::Stage\u003C\u002Fcode> resources:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>rule apigw_access_logs_enabled_check when\n    resourceType == "AWS::ApiGateway::Stage"\n    {\n        configuration.accessLogSettings.destinationArn is_string\n    }\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>Require execution logging is enabled\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>Resources\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fset-up-logging.html\">Setting up CloudWatch logging for a REST API in API Gateway\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Preventative controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>N\u002FA. IAM and SCPs for API Gateway do not have conditions related to the execution logs.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Proactive controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Custom AWS CloudFormation Hook.\u003C\u002Fp>\n\u003Cp>\u003Cem>Note: Proactive controls may block the first deployment of a new API from the AWS Management Console. The AWS Console does not allow you to specify the execution logs settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referring to a deployment. Creating a stage using IaC or the AWS CLI works as expected as the deployment ID is optional.\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Detective controls\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS Config rule - \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-execution-logging-enabled.html\">https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-execution-logging-enabled.html\u003C\u002Fa>\u003C\u002Fp>\n",{"title":6,"order":7},"Enforcing observability for governance",8,"The following use case shows how to enforce observability for Amazon API Gateway governance using the following controls: \n* Require AWS X-Ray tracing is enabled\n* Require access logging is enabled\n* Require execution logging is enabled\n\n#### Require AWS X-Ray tracing is enabled\n\n**Resources**\n\n- [Setting up AWS X-Ray with API Gateway REST APIs](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-enabling-xray.html)\n- [Amazon API Gateway active tracing support for AWS X-Ray](https:\u002F\u002Fdocs.aws.amazon.com\u002Fxray\u002Flatest\u002Fdevguide\u002Fxray-services-apigateway.html)\n- [Amazon API Gateway API Reference - CreateStage](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fapi\u002FAPI_CreateStage.html#apigw-CreateStage-request-tracingEnabled)\n\n**Preventative controls**\n\nN\u002FA. AWS Identity and Access Management (IAM) and service control policies (SCP) for API Gateway do not have conditions related to AWS X-Ray.\n\n**Proactive controls**\n\nAWS Config rule - https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-xray-enabled.html\n\n*Note: Proactive controls may block the first deployment for a new API using the AWS Management Console. The AWS Console does not allow you to specify the X-Ray settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referencing a deployment. Creating a stage using Infrastructure as Code (IaC) or the AWS CLI works as expected as the deployment ID is optional.*\n\n**Detective controls**\n\nAWS Config rule - https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-xray-enabled.html\n\n#### Require access logging is enabled\n\n**Resources**\n- [Setting up CloudWatch logging for a REST API in API Gateway](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fset-up-logging.html)\n- [AccessLoggingDestination - Actions, resources, and condition keys for Amazon API Gateway Management](https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html#amazonapigatewaymanagement-apigateway_Resource_AccessLoggingDestination)\n- [AccessLoggingFormat - Actions, resources, and condition keys for Amazon API Gateway Management](https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html#amazonapigatewaymanagement-apigateway_Request_AccessLoggingFormat)\n\n**Preventative controls**\n\nYou can use a SCP that prevents any create\u002Fupdate actions on API Gateway stages that do not have an access logging destination or a log format specified. Use conditions `apigateway:Resource\u002FAccessLoggingDestination` and  `apigateway:Request\u002FAccessLoggingFormat`. Optionally, a SCP can use these conditions for more fine-grained control over what needs to be logged and where logs should be delivered to. \nFor example, the following policy prevents users from creating a new or updating an existing stage if it does not have an access logs destination specified:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"Statement1\",\n      \"Effect\": \"Deny\",\n      \"Action\": [\n        \"apigateway:PATCH\",\n        \"apigateway:POST\",\n        \"apigateway:PUT\"\n      ],\n      \"Resource\": [\n        \"arn:aws:apigateway:*::\u002Frestapis\u002F*\u002Fstages\u002F*\"\n      ],\n      \"Condition\": {\n        \"StringLikeIfExists\": {\n          \"apigateway:Request\u002FAccessLoggingDestination\": \"\"\n        }\n      }\n    }\n  ]\n}\n```\n\n*Note: Preventative controls would block the initial setup of a new stage using the AWS Management Console. The AWS Console does not allow you to specify the access logs settings for a new stage when it is created.* \n\n**Detective controls**\n\nAWS Config custom rule [using Guard](https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fevaluate-config_develop-rules_cfn-guard.html), enabled for all `AWS::ApiGateway::Stage` resources:\n\n```\nrule apigw_access_logs_enabled_check when\n    resourceType == \"AWS::ApiGateway::Stage\"\n    {\n        configuration.accessLogSettings.destinationArn is_string\n    }\n```\n\n#### Require execution logging is enabled\n\n**Resources**\n- [Setting up CloudWatch logging for a REST API in API Gateway](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fset-up-logging.html)\n\n**Preventative controls**\n\nN\u002FA. IAM and SCPs for API Gateway do not have conditions related to the execution logs.\n\n**Proactive controls**\n\nCustom AWS CloudFormation Hook.\n\n*Note: Proactive controls may block the first deployment of a new API from the AWS Management Console. The AWS Console does not allow you to specify the execution logs settings for a new stage when it is created as part of the first deployment. It also does not allow you to create a stage without referring to a deployment. Creating a stage using IaC or the AWS CLI works as expected as the deployment ID is optional.*\n\n**Detective controls**\n\nAWS Config rule - https:\u002F\u002Fdocs.aws.amazon.com\u002Fconfig\u002Flatest\u002Fdeveloperguide\u002Fapi-gw-execution-logging-enabled.html",[10],"content\u002Fcontributors\u002Fgiedrius-praspaliauskas.json","LIST","Amazon API Gateway governance in depth","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fobservability","3 min",[16,59,84],{"title":17,"content":18},"Amazon API Gateway governance",[19,32,39,46,53],{"title":20,"order":21,"authors":22,"callout":24,"time":28,"path":29,"id":30,"link":31},"Introduction",1,[23],"Giedrius Praspaliauskas",{"title":25,"description":26,"link":27},"Building an API platform on AWS","This guide summarizes the API lifecycle and provides an AWS point of view on building an API platform using Amazon API Gateway. It provides prescriptive guidance on 3rd party and AWS services to cover the end-to-end needs of the API lifecycle.","https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fintroduction","1 min","introduction","introduction.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fintroduction",{"title":33,"order":34,"time":35,"path":36,"id":37,"link":38},"Security controls",2,"2 min","controls","controls.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fcontrols",{"title":40,"order":41,"time":42,"path":43,"id":44,"link":45},"Tools",3,"7 min","tools","tools.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Ftools",{"title":47,"order":48,"time":49,"path":50,"id":51,"link":52},"API management access control",4,"4 min","management_access","management_access.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement_access",{"title":54,"order":55,"time":28,"path":56,"id":57,"link":58},"API management audit",5,"audit_track","audit_track.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faudit_track",{"title":60,"content":61},"Use cases and examples",[62,68,71,78],{"title":63,"order":64,"time":28,"path":65,"id":66,"link":67},"Use-cases overview",6,"use_cases","use_cases.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fuse_cases",{"title":6,"order":7,"time":14,"path":69,"id":70,"link":13},"observability","observability.md",{"title":72,"order":73,"time":74,"path":75,"id":76,"link":77},"Enforcing security for governance",9,"5 min","access_control","access_control.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faccess_control",{"title":79,"order":80,"time":49,"path":81,"id":82,"link":83},"Enforcing management control",10,"management","management.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement",{"title":85,"content":86},"Summary",[87,93],{"title":88,"order":89,"time":28,"path":90,"id":91,"link":92},"Index of examples",11,"index","index.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Findex",{"title":94,"order":95,"time":28,"path":96,"id":97,"link":98},"Additional resources",12,"additional_resources","additional_resources.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fadditional_resources",1792665264210]