# Ensure API Gateway X-Ray Tracing Enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000219454-ensure-api-gateway-x-ray-tracing-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:** 

AWS X-Ray helps developers analyze and debug production, distributed applications, such as those built using a microservices architecture. With X-Ray, you can understand how your application and its underlying services are performing to identify and troubleshoot the root cause of performance issues and errors.

  

## **Rationale:**

You can use AWS X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway REST APIs to the underlying services. API Gateway supports X-Ray tracing for all API Gateway REST API endpoint types: Regional, edge-optimized, and private. You can use X-Ray with Amazon API Gateway in all AWS Regions where X-Ray is available.

  

## **Impact:**

X-Ray gives you an end-to-end view of an entire request, you can analyze latencies in your APIs and their backend services. You can use an X-Ray service map to view the latency of an entire request and that of the downstream services that are integrated with X-Ray.

  

## **Default Value:**

There are two modes of tracing for an API Gateway API:

-   **Passive**: This is the default setting if you have not enabled X-Ray tracing on an API stage. This approach means that the API Gateway API is only traced if X-Ray has been enabled on an upstream service.
    
-   **Active**: When an API Gateway API stage has this setting, API Gateway automatically samples API invocation requests, based on the sampling algorithm specified by X-Ray.   
      
    

### **Pre-requisites:**

Sign in as admin or IAM user with required permissions

## ****Remediation**:**

## **Test Plan:**

1.  Login to AWS Management console
    
2.  Go to the API Gateway console at [https://console.aws.amazon.com/apigateway](https://console.aws.amazon.com/apigateway "https://console.aws.amazon.com/apigateway").
    
3.  In the **APIs** pane, choose the API, and then choose **Stages**.![](https://support.icompaas.com/assets/kb/7bfae300d915e4a8.png)
    
4.  In the **Stages** pane, choose the name of the stage.
    
5.  In the **Stage Editor** pane, choose the **Logs/Tracing** tab.
    
6.  Check whether **Enable X-Ray Tracing** is checked/unchecked.![](https://support.icompaas.com/assets/kb/0c248df553492eb6.png)
    
7.  If unchecked follow the implementation step.
    

  

**Using AWS CLI:** 

To check whether Xray enabled

aws apigateway get-stages
  --region us-east-1
  --rest-api-id <value>
  --query 'item\[?(stageName==\`<value>\`)\].tracingEnabled | \[\]'

  

  

### **Implementation steps:**

1.  Login to AWS Management console
    
2.  Go to the API Gateway console at [https://console.aws.amazon.com/apigateway](https://console.aws.amazon.com/apigateway "https://console.aws.amazon.com/apigateway").
    
3.  Click on **APIs,** in the left navigation pane![](https://support.icompaas.com/assets/kb/8f1323d7c4478510.png)
    
4.  Choose the API, and then click on **Stages**.![](https://support.icompaas.com/assets/kb/1c1f430daebeb05e.png)  
    
5.  In the **Stages** pane, choose the name of the stage.  
    ![](https://support.icompaas.com/assets/kb/ebf2484a33e94724.png)
    
6.  In the **Stage Edito****r** page, go to the **Logs/Tracing** tab.  
    ![](https://support.icompaas.com/assets/kb/0e6f208505a5b0d9.png)
    
7.  To enable X-Ray tracing, check **Enable X-Ray Tracing** checkBox under **X-Ray** **Tracing** section. Click on **Save** **Changes![](https://support.icompaas.com/assets/kb/95702490e0f4dc22.png)** 
    
8.  **Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps.**
    

  

****Using AWS CLI:**** 

**Too enable xray tracing** 

aws apigateway update-stage          \\
    --rest-api-id {rest-api-id}      \\
    --stage-name {stage-name}      \\
    --patch-operations op=replace,path=/tracingEnabled,value=true

  

### **Backout plan:**

1.  Log in to AWS Management console
    
2.  Go to the API Gateway console at [https://console.aws.amazon.com/apigateway](https://console.aws.amazon.com/apigateway "https://console.aws.amazon.com/apigateway").
    
3.  In the **APIs** pane, choose the API, and then choose **Stages**.
    
4.  In the **Stages** pane, choose the name of the stage.
    
5.  In the **Stage Editor** pane, choose the **Logs/Tracing** tab.
    
6.  Uncheck **Enable X-Ray Tracing** under **X-Ray Tracing**. Click **Save Changes**
    

  

****Using AWS CLI:**** 

**Too disable xray tracing** 

aws apigateway update-stage          \\
    --rest-api-id {rest-api-id}      \\
    --stage-name {stage-name}      \\
    --patch-operations op=replace,path=/tracingEnabled,value=false

  

## **Notes:**

Once you've enabled X-Ray for your API stage, you can use the X-Ray management console to view the traces and service maps

To create an API follow this documentation : [Tutorial: Build a REST API with HTTP proxy integration -](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-api-as-simple-proxy-for-http.html "https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-api-as-simple-proxy-for-http.html") [Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-api-as-simple-proxy-for-http.html "https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-api-as-simple-proxy-for-http.html")

  

### **References**:

[Setting up a stage using the API Gateway console - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html "https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.