Back to Checks
aws

API Gateway REST API stage has X-Ray tracing enabled

apigateway_restapi_tracing_enabled
Service: apigatewaySeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsApiGatewayStage

API Gateway REST API stages have AWS X-Ray active tracing enabled to sample incoming requests and produce distributed traces across connected services.

Prowler logoProwlerprowler-provider-aws

Risk

Without X-Ray tracing, you lose end-to-end visibility, hindering detection of timeouts, errors, and anomalous latency.

This delays incident response and root-cause analysis, increasing MTTR and risking partial outages (availability) and undetected integration failures (integrity).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks apigateway_restapi_tracing_enabled

Recommendation

Enable X-Ray active tracing on all API Gateway stages and propagate trace context through downstream services.

Use prudent sampling, correlate traces with logs/metrics, and alert on errors/latency. Apply least privilege to X-Ray access and use defense in depth for observability.

Remediation

CLI

aws apigateway update-stage --rest-api-id <restapi-id> --stage-name <stage-name> --patch-operations op=replace,path=/tracingEnabled,value=true

Terraform

# Enable X-Ray tracing on an API Gateway REST API stage
resource "aws_api_gateway_stage" "example" {
  rest_api_id = "<example_resource_id>"
  deployment_id = "<example_resource_id>"
  stage_name  = "<example_resource_name>"
  xray_tracing_enabled = true  # Critical: enables AWS X-Ray tracing for this stage
}

NativeIaC

# CloudFormation: Enable X-Ray tracing on an API Gateway REST API stage
Resources:
  <example_resource_name>:
    Type: AWS::ApiGateway::Stage
    Properties:
      RestApiId: <example_resource_id>
      DeploymentId: <example_resource_id>
      StageName: <example_resource_name>
      TracingEnabled: true  # Critical: enables AWS X-Ray tracing for this stage

Other

1Open the AWS Console and go to API Gateway
2Select your REST API and choose Stages
3Select the target stage
4Open the Logs/Tracing tab, check Enable X-Ray Tracing
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.apigateway.apigateway_client import (
    apigateway_client,
)


class apigateway_restapi_tracing_enabled(Check):
    def execute(self):
        findings = []
        for rest_api in apigateway_client.rest_apis:
            for stage in rest_api.stages:
                report = Check_Report_AWS(metadata=self.metadata(), resource=stage)
                report.region = rest_api.region
                report.resource_id = rest_api.name
                report.status = "FAIL"
                report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} does not have X-Ray tracing enabled."
                if stage.tracing_enabled:
                    report.status = "PASS"
                    report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has X-Ray tracing enabled."
                findings.append(report)

        return findings

References