API Gateway REST API stage has X-Ray tracing enabled

Check ID: apigateway_restapi_tracing_enabled
Provider: AWS
Service: apigateway
Severity: LOW
Categories: logging
Resource type: AwsApiGatewayStage

What this check verifies

API Gateway REST API stages have AWS X-Ray active tracing enabled to sample incoming requests and produce distributed traces across connected services.

Risk

Without X-Ray tracing, you lose end-to-end visibility, hindering detection of timeouts, errors, and anomalous latency. This delays incident response and root-cause analysis, increasing MTTR and risking partial outages (availability) and undetected integration failures (integrity).

Recommendation

Enable X-Ray active tracing on all API Gateway stages and propagate trace context through downstream services. Use prudent sampling, correlate traces with logs/metrics, and alert on errors/latency. Apply least privilege to X-Ray access and use defense in depth for observability.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws apigateway update-stage --rest-api-id <restapi-id> --stage-name <stage-name> --patch-operations op=replace,path=/tracingEnabled,value=true

# Enable X-Ray tracing on an API Gateway REST API stage
resource "aws_api_gateway_stage" "example" {
  rest_api_id = "<example_resource_id>"
  deployment_id = "<example_resource_id>"
  stage_name  = "<example_resource_name>"
  xray_tracing_enabled = true  # Critical: enables AWS X-Ray tracing for this stage
}

# CloudFormation: Enable X-Ray tracing on an API Gateway REST API stage
Resources:
  <example_resource_name>:
    Type: AWS::ApiGateway::Stage
    Properties:
      RestApiId: <example_resource_id>
      DeploymentId: <example_resource_id>
      StageName: <example_resource_name>
      TracingEnabled: true  # Critical: enables AWS X-Ray tracing for this stage

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigateway_restapi_tracing_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Public API Gateway REST API has an authorizer API Gateway stage has a WAF Web ACL attached

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires