> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Active Tracing Should Be Enabled For API Gateway Stages

### More Info:

Active tracing should be enabled for your Amazon API Gateway API stages to sample incoming requests and send traces to AWS X-Ray. Then X-Ray can provide you an end-to-end view of an entire HTTP request, so you can analyze latencies in your APIs and their backend services.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

CBP

### Triage and Remediation

<Tabs>
  <Tab title="Cause">
    ### Check Cause

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        1. Sign in to the AWS Management Console and open the Amazon API Gateway console at [https://console.aws.amazon.com/apigateway/](https://console.aws.amazon.com/apigateway/).

        2. In the navigation pane, choose 'APIs'.

        3. Select the API you want to check, then in the 'Stages' section, select the stage you want to inspect.

        4. In the 'Logs/Tracing' tab, check the 'Enable X-Ray Tracing' box. If it's not checked, Active Tracing is not enabled for that API Gateway Stage.
      </Accordion>

      <Accordion title="Using CLI">
        1. First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the API Gateway.

        2. Once the AWS CLI is installed and configured, you can list all the APIs in your account by running the following command:

           ```
           aws apigateway get-rest-apis
           ```

           This command will return a list of all the APIs in your account.

        3. For each API, you can list all the stages by running the following command:

           ```
           aws apigateway get-stages --rest-api-id <rest-api-id>
           ```

           Replace `<rest-api-id>` with the ID of the API you want to check. This command will return a list of all the stages for the specified API.

        4. For each stage, you can check if active tracing is enabled by looking at the `tracingEnabled` field in the output. If this field is set to `false`, then active tracing is not enabled for that stage.
      </Accordion>

      <Accordion title="Using Python">
        1. Install the necessary Python libraries: Before you start, make sure you have the necessary Python libraries installed. You will need the boto3 library, which is the Amazon Web Services (AWS) SDK for Python. It allows Python developers to write software that makes use of services like Amazon S3, Amazon EC2, and others. You can install it using pip:

           ```python theme={null}
           pip install boto3
           ```

        2. Set up AWS credentials: You need to configure your AWS credentials. You can set your credentials for use by boto3 in several ways, but the simplest is to use the AWS CLI. Run `aws configure` and then enter your access key, secret access key, and default region when prompted.

        3. Write a Python script to check the active tracing status: You can use the `get_stage` method provided by the boto3 library to retrieve the information about a specific stage for a RestApi resource. The `tracingEnabled` attribute in the response indicates whether active tracing is enabled for the API Gateway stage.

           Here is a sample script:

           ```python theme={null}
           import boto3

           client = boto3.client('apigateway')

           response = client.get_stage(
               restApiId='your_rest_api_id',
               stageName='your_stage_name'
           )

           if 'tracingEnabled' in response:
               if response['tracingEnabled']:
                   print("Active tracing is enabled for this API Gateway stage.")
               else:
                   print("Active tracing is not enabled for this API Gateway stage.")
           else:
               print("The 'tracingEnabled' attribute is not present in the response.")
           ```

           Replace 'your\_rest\_api\_id' and 'your\_stage\_name' with your actual RestApi ID and stage name.

        4. Run the script: Save the script to a file, then run it using your Python interpreter. The script will print a message indicating whether active tracing is enabled for the specified API Gateway stage. If the 'tracingEnabled' attribute is not present in the response, the script will print a message indicating this.
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Active Tracing Should Be Enabled For API Gateway Stages" for AWS using AWS console, you can follow the below steps:

        1. Open the AWS Management Console and navigate to the API Gateway service.

        2. Select the API Gateway that contains the stage for which you want to enable active tracing.

        3. Click on the Stages tab and select the stage for which you want to enable active tracing.

        4. Click on the Settings tab and scroll down to the "Tracing" section.

        5. Click on the "Edit" button next to the "Tracing" section.

        6. Select the "Enable Active tracing" checkbox.

        7. Choose the appropriate tracing level - "ERROR", "INFO", or "DEBUG" based on your requirements.

        8. Click on the "Save Changes" button to enable active tracing for the selected stage.

        9. Repeat this process for all the stages in your API Gateway.

        By following these steps, you can remediate the misconfiguration "Active Tracing Should Be Enabled For API Gateway Stages" for AWS using AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate this misconfiguration for AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to enable active tracing for API Gateway stages:

        ```
        aws apigateway update-stage --rest-api-id <rest-api-id> --stage-name <stage-name> --patch-operations '[{"op":"replace","path":"/tracingEnabled","value":"True"}]'
        ```

        Note: Replace `<rest-api-id>` with the ID of your API Gateway REST API and `<stage-name>` with the name of the stage you want to enable active tracing for.

        3. Verify that active tracing has been enabled for the specified stage by running the following command:

        ```
        aws apigateway get-stage --rest-api-id <rest-api-id> --stage-name <stage-name> | grep tracingEnabled
        ```

        Note: Replace `<rest-api-id>` with the ID of your API Gateway REST API and `<stage-name>` with the name of the stage you enabled active tracing for.

        4. If the output of the previous command shows `"tracingEnabled": true`, then active tracing has been successfully enabled for the specified stage. If it shows `"tracingEnabled": false`, then repeat steps 2 and 3 to ensure that active tracing is properly enabled.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Active Tracing Should Be Enabled For API Gateway Stages" for AWS using Python, you can follow the below steps:

        1. Install the AWS SDK for Python (Boto3) using the following command:

        ```
        pip install boto3
        ```

        2. Create a Boto3 client for the Amazon API Gateway service:

        ```python theme={null}
        import boto3

        client = boto3.client('apigateway')
        ```

        3. List all the API Gateway stages for the specified API using the following command:

        ```python theme={null}
        stages = client.get_stages(restApiId='REST_API_ID')
        ```

        Note: Replace 'REST\_API\_ID' with the ID of your API Gateway.

        4. For each stage, check if active tracing is enabled using the following command:

        ```python theme={null}
        for stage in stages['item']:
            tracing_enabled = client.get_stage(restApiId='REST_API_ID', stageName=stage['stageName'])['tracingEnabled']
        ```

        5. If active tracing is not enabled, enable it using the following command:

        ```python theme={null}
        if not tracing_enabled:
            client.update_stage(restApiId='REST_API_ID', stageName=stage['stageName'], patchOperations=[{'op': 'replace', 'path': '/tracingEnabled', 'value': 'True'}])
        ```

        6. Run the Python script to remediate the misconfiguration.

        Note: Make sure to replace 'REST\_API\_ID' with the ID of your API Gateway.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/xray/latest/devguide/xray-services-apigateway.html](https://docs.aws.amazon.com/xray/latest/devguide/xray-services-apigateway.html)