Skip to content

API Gateway Tracing

Level: Warning

Initial version: 0.1.3

cfn-lint: WS2002

tflint (REST): aws_apigateway_stage_tracing_rule

tflint (HTTP): Not supported

Amazon API Gateway can emit traces to AWS X-Ray, which enable visualizing service maps for faster troubleshooting.

AWS SAM templates

For AWS::Serverless::Api resources, this rule checks the effective TracingEnabled property, including values inherited from Globals.Api. HTTP APIs (AWS::Serverless::HttpApi and implicit HttpApi events) do not support X-Ray tracing and are not checked. For AWS::Serverless::Api and AWS::Serverless::HttpApi resources, this rule checks the effective stage settings directly, including values inherited from Globals.Api or Globals.HttpApi. Function Api events without RestApiId and HttpApi events without ApiId create implicit APIs, which are also checked using the applicable global settings; each implicit API finding is reported once per owning function, so functions sharing an implicit API can each receive a finding.

Implementations for REST APIs

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
import { RestApi } from '@aws-cdk/aws-apigateway';

export class MyStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const myApi = new RestApi(
      scope, 'MyApi',
      {
        // Enable tracing on API Gateway
        deployOptions: {
          tracingEnabled: true,
        },
      }
    );
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
{
  "Resources": {
    "Api": {
      "Type": "AWS::Serverless::Api",
      "Properties": {
        "DefinitionUri": "openapi.yaml",
        "StageName": "prod",

        // Enable tracing on API Gateway
        "TracingEnabled": true
      }
    }
  }
}

1
2
3
4
5
6
7
8
9
Resources:
  Api:
    Type: AWS::Serverless::Api
    Properties:
      DefinitionUri: openapi.yaml
      StageName: prod

      # Enable tracing on API Gateway
      TracingEnabled: true

1
2
3
4
5
provider:
  name: aws
  # Enable tracing on API Gateway
  tracing:
    apiGateway: true

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
resource "aws_api_gateway_rest_api" "this" {
  body = file("openapi.yaml")
}

resource "aws_api_gateway_deployment" "this" {
  rest_api_id = aws_api_gateway_rest_api.this.id

  triggers = {
    redeployment = sha1(jsonencode(aws_api_gateway_rest_api.this.body))
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_api_gateway_stage" "this" {
  deployment_id = aws_api_gateway_deployment.this.id
  rest_api_id   = aws_api_gateway_rest_api.this.id
  stage_name    = "prod"

  # Enable tracing on API Gateway
  xray_tracing_enabled = true
}

Implementations for HTTP APIs

Remark: HTTP APIs do not support tracing at the moment.

Why is this a warning?

You might use third party solutions for monitoring serverless applications. If this is the case, enabling tracing for API Gateway might be optional. Refer to the documentation of your monitoring solutions to see if you should enable AWS X-Ray tracing or not.

See also