API Gateway X-Ray Disabled
- Query id: 4ab10c48-bedb-4deb-8f3b-ff12783b61de
- Query name: API Gateway X-Ray Disabled
- Platform: CloudFormation
- Severity: Medium
- Category: Observability
- URL: Github
Description¶
API Gateway should have X-Ray Tracing enabled
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
AWSTemplateFormatVersion: "2010-09-09"
Description: "BatchJobDefinition"
Resources:
ProdPos3:
Type: AWS::ApiGateway::Stage
Properties:
StageName: Prod
Description: Prod Stage
RestApiId: !Ref MyRestApi
DeploymentId: !Ref TestDeployment
DocumentationVersion: !Ref MyDocumentationVersion
ClientCertificateId: !Ref ClientCertificate
TracingEnabled: false
Variables:
Stack: Prod
MethodSettings:
- ResourcePath: /
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
- ResourcePath: /stack
HttpMethod: POST
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '999'
- ResourcePath: /stack
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '555'
Postitive test num. 2 - yaml file
AWSTemplateFormatVersion: "2010-09-09"
Description: "BatchJobDefinition"
Resources:
ProdPos4:
Type: AWS::ApiGateway::Stage
Properties:
StageName: Prod
Description: Prod Stage
RestApiId: !Ref MyRestApi
DeploymentId: !Ref TestDeployment
DocumentationVersion: !Ref MyDocumentationVersion
ClientCertificateId: !Ref ClientCertificate
Variables:
Stack: Prod
MethodSettings:
- ResourcePath: /
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
- ResourcePath: /stack
HttpMethod: POST
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '999'
- ResourcePath: /stack
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '555'
Postitive test num. 3 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"ProdPos1": {
"Type": "AWS::ApiGateway::Stage",
"Properties": {
"StageName": "Prod",
"RestApiId": {
"Ref": "MyRestApi"
},
"DeploymentId": {
"Ref": "TestDeployment"
},
"DocumentationVersion": {
"Ref": "MyDocumentationVersion"
},
"ClientCertificateId": {
"Ref": "ClientCertificate"
},
"Variables": {
"Stack": "Prod"
},
"TracingEnabled": "false",
"MethodSettings": [
{
"ResourcePath": "/",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"DataTraceEnabled": "false"
},
{
"ResourcePath": "/stack",
"HttpMethod": "POST",
"MetricsEnabled": "true",
"DataTraceEnabled": "false",
"ThrottlingBurstLimit": "999"
},
{
"ResourcePath": "/stack",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"DataTraceEnabled": "false",
"ThrottlingBurstLimit": "555"
}
]
}
}
}
}
Postitive test num. 4 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"ProdPos2": {
"Type": "AWS::ApiGateway::Stage",
"Properties": {
"StageName": "Prod",
"RestApiId": {
"Ref": "MyRestApi"
},
"DeploymentId": {
"Ref": "TestDeployment"
},
"DocumentationVersion": {
"Ref": "MyDocumentationVersion"
},
"ClientCertificateId": {
"Ref": "ClientCertificate"
},
"Variables": {
"Stack": "Prod"
},
"MethodSettings": [
{
"ResourcePath": "/",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"DataTraceEnabled": "false"
},
{
"ResourcePath": "/stack",
"HttpMethod": "POST",
"MetricsEnabled": "true",
"DataTraceEnabled": "false",
"ThrottlingBurstLimit": "999"
},
{
"ResourcePath": "/stack",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"DataTraceEnabled": "false",
"ThrottlingBurstLimit": "555"
}
]
}
}
}
}
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
AWSTemplateFormatVersion: "2010-09-09"
Description: "BatchJobDefinition"
Resources:
ProdNeg1:
Type: AWS::ApiGateway::Stage
Properties:
StageName: Prod
Description: Prod Stage
RestApiId: !Ref MyRestApi
DeploymentId: !Ref TestDeployment
DocumentationVersion: !Ref MyDocumentationVersion
ClientCertificateId: !Ref ClientCertificate
TracingEnabled: true
Variables:
Stack: Prod
MethodSettings:
- ResourcePath: /
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
- ResourcePath: /stack
HttpMethod: POST
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '999'
- ResourcePath: /stack
HttpMethod: GET
MetricsEnabled: 'true'
DataTraceEnabled: 'false'
ThrottlingBurstLimit: '555'
Negative test num. 2 - json file
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"ProdNeg2": {
"Type": "AWS::ApiGateway::Stage",
"Properties": {
"StageName": "Prod",
"RestApiId": {
"Ref": "MyRestApi"
},
"DeploymentId": {
"Ref": "TestDeployment"
},
"DocumentationVersion": {
"Ref": "MyDocumentationVersion"
},
"ClientCertificateId": {
"Ref": "ClientCertificate"
},
"Variables": {
"Stack": "Prod"
},
"TracingEnabled": "true",
"MethodSettings": [
{
"ResourcePath": "/",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"DataTraceEnabled": "false"
},
{
"ResourcePath": "/stack",
"HttpMethod": "POST",
"MetricsEnabled": "true",
"DataTraceEnabled": "false",
"ThrottlingBurstLimit": "999"
},
{
"ResourcePath": "/stack",
"HttpMethod": "GET",
"MetricsEnabled": "true",
"DataTraceEnabled": "false",
"ThrottlingBurstLimit": "555"
}
]
}
}
}
}