Cloudwatch Metrics Must Be Enabled For All APIs

More Info:

Detailed CloudWatch metrics should be enabled for all APIs created with AWS API Gateway service in order to monitor API stages caching, latency and detected errors at a more granular level and set alarms accordingly.

Risk Level

Low

Address

Operational Maturity

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• HIPAA
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• StateRAMP
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Cause

Check Cause

Using Console

1. Log in to the AWS Management Console and navigate to the API Gateway service.
2. In the API Gateway dashboard, select the APIs section on the left-hand side.
3. In the APIs list, select the API you want to check. This will open the API’s settings.
4. In the API settings, navigate to the Stages section. Here, you can see if CloudWatch metrics are enabled for each stage of the API. If the CloudWatch metrics are not enabled, it indicates a misconfiguration.

Using CLI

1. Install and configure AWS CLI: Before you can start using AWS CLI, you need to install it on your local machine and configure it with your AWS account credentials. You can do this by running the following commands:

   Installation:

   pip install awscli
   

   Configuration:

   aws configure
   

   You will be prompted to enter your AWS Access Key ID, Secret Access Key, Default region name, and Default output format.

2. List all APIs: Use the following command to list all the APIs in API Gateway:

   aws apigateway get-rest-apis
   

   This command will return a list of all the APIs in your AWS account.

3. Check Cloudwatch Metrics for each API: For each API in the list, you need to check if Cloudwatch Metrics are enabled. You can do this by running the following command for each API:

   aws apigateway get-stage --rest-api-id <api-id> --stage-name <stage-name>
   

   Replace <api-id> with the ID of the API and <stage-name> with the name of the stage you want to check. This command will return the details of the specified stage.

4. Verify Cloudwatch Metrics: In the output of the previous command, look for the metricsEnabled field. If its value is true, then Cloudwatch Metrics are enabled for that API. If its value is false or if the metricsEnabled field is not present, then Cloudwatch Metrics are not enabled for that API.

Using Python

1. Setup AWS SDK (Boto3): First, you need to set up AWS SDK (Boto3) in your Python environment. You can install it using pip:

   pip install boto3
   

   After installing boto3, configure your AWS credentials either by setting up environment variables or by using the AWS CLI.

2. List all APIs in API Gateway: Use the get_rest_apis function from the apigateway client in boto3 to get a list of all APIs in API Gateway. Here is a sample script:

   import boto3
   
   def list_apis():
       client = boto3.client('apigateway')
       response = client.get_rest_apis()
       return response['items']
   
   apis = list_apis()
   for api in apis:
       print(api['name'])
   

   This script will print the names of all APIs in API Gateway.

3. Check CloudWatch Metrics for each API: For each API, check if CloudWatch metrics are enabled. You can do this by checking the metricsEnabled attribute of the methodSettings for each method of each resource of the API. Here is a sample script:

   import boto3
   
   def check_metrics(api):
       client = boto3.client('apigateway')
       resources = client.get_resources(restApiId=api['id'])['items']
       for resource in resources:
           methods = resource.get('resourceMethods', {})
           for method in methods:
               settings = client.get_method_settings(
                   restApiId=api['id'],
                   resourceId=resource['id'],
                   httpMethod=method
               )
               if not settings['methodSettings']['metricsEnabled']:
                   print(f"CloudWatch Metrics not enabled for API {api['name']}, resource {resource['path']}, method {method}")
   
   apis = list_apis()
   for api in apis:
       check_metrics(api)
   

   This script will print the names of APIs, resources, and methods for which CloudWatch Metrics are not enabled.

4. Interpret the Results: If the script prints any APIs, resources, and methods, it means that CloudWatch Metrics are not enabled for them. If it doesn’t print anything, it means that CloudWatch Metrics are enabled for all APIs in API Gateway.

Remediation

Remediation

Using Console

To remediate the misconfiguration “Cloudwatch Metrics Must Be Enabled For All APIs” for AWS using AWS console, follow the below steps:

1. Open the AWS Management Console and go to the Amazon API Gateway service.

2. Select the API for which you want to enable CloudWatch metrics.

3. Click on the “Stages” option from the left-hand side menu.

4. Select the stage for which you want to enable CloudWatch metrics.

5. Click on the “Logs/Tracing” tab.

6. Under the “CloudWatch Settings” section, check the box next to “Enable CloudWatch Logs” and “Enable CloudWatch Metrics”.

7. Select the appropriate log format for your API.

8. Click on the “Save Changes” button.

9. Repeat the above steps for all the APIs and stages that you want to enable CloudWatch metrics for.

By following these steps, you can remediate the misconfiguration “Cloudwatch Metrics Must Be Enabled For All APIs” for AWS using AWS console.

Using CLI

To remediate the misconfiguration “Cloudwatch Metrics Must Be Enabled For All APIs” in AWS using AWS CLI, follow the below steps:

1. Open the AWS CLI on your local machine and run the following command to enable CloudWatch metrics for all existing APIs in your AWS account:

aws apigateway update-account --metrics-enabled

2. To ensure that CloudWatch metrics are enabled for all new APIs created in your account, run the following command:

aws apigateway update-rest-api --rest-api-id <rest-api-id> --patch-operations op=replace,path=/metrics/enabled,value=true

Note: Replace <rest-api-id> with the ID of your REST API.

3. To verify that CloudWatch metrics are enabled for all APIs, run the following command:

aws apigateway get-account

This command should return a JSON object with the following key-value pair:

"metricsEnabled": true

4. To verify that CloudWatch metrics are enabled for a specific API, run the following command:

aws apigateway get-rest-api --rest-api-id <rest-api-id>

This command should return a JSON object with the following key-value pair:

"metrics": {
    "enabled": true
}

Note: Replace <rest-api-id> with the ID of your REST API.

By following these steps, you will have successfully remediated the misconfiguration “Cloudwatch Metrics Must Be Enabled For All APIs” in AWS using AWS CLI.

Using Python

To remediate the misconfiguration “Cloudwatch Metrics Must Be Enabled For All APIs” for AWS using Python, you can follow these steps:

1. Import the necessary AWS SDK for Python (Boto3) library.

import boto3

2. Create a Boto3 client for the Amazon API Gateway service.

apigateway = boto3.client('apigateway')

3. Get a list of all the APIs in your AWS account using the get_rest_apis method.

response = apigateway.get_rest_apis()

4. Loop through the list of APIs and enable CloudWatch metrics for each one using the update_stage method.

for api in response['items']:
    stages = apigateway.get_stages(restApiId=api['id'])
    for stage in stages['item']:
        apigateway.update_stage(restApiId=api['id'], stageName=stage['stageName'], patchOperations=[{'op': 'replace', 'path': '/metrics/enabled', 'value': 'true'}])

This code snippet will enable CloudWatch metrics for all APIs and stages in your AWS account. You can run this code as a Python script or integrate it into your existing infrastructure-as-code (IaC) pipeline to ensure that CloudWatch metrics are always enabled for your APIs.

Using Terraform

resource "aws_api_gateway_rest_api" "THIS_API" {
  name = "REPLACE_WITH_API_NAME"
}

resource "aws_api_gateway_deployment" "THIS_DEPLOYMENT" {
  rest_api_id = aws_api_gateway_rest_api.THIS_API.id

  # REPLACE_WITH_STAGE_NAME should match the stage below
  stage_name = "REPLACE_WITH_STAGE_NAME"
}

resource "aws_api_gateway_stage" "THIS_STAGE" {
  rest_api_id  = aws_api_gateway_rest_api.THIS_API.id
  deployment_id = aws_api_gateway_deployment.THIS_DEPLOYMENT.id
  stage_name    = "REPLACE_WITH_STAGE_NAME" # substitute with the non‑compliant stage name

  # Enable detailed CloudWatch metrics for all methods in this stage, equivalent to
  # patch path='/*/*/metrics/enabled',value='true'
  method_settings {
    resource_path = "/*"
    http_method   = "*"

    metrics_enabled = true
    # optional but commonly used with metrics:
    # logging_level   = "INFO"
    # data_trace_enabled = true
  }
}

Notes:

• Enabling metrics_enabled = true on resource_path = "/*" and http_method = "*" makes detailed CloudWatch metrics apply to all methods in the stage, matching the CLI operation path='/*/*/metrics/enabled',value='true'.
• WARNING: Enabling detailed CloudWatch metrics may incur additional CloudWatch charges.
• This change updates the stage configuration in place and does not force replacement of the REST API; terraform plan should show an in-place update to aws_api_gateway_stage.THIS_STAGE with metrics_enabled changing from false (or null) to true under method_settings.

Additional Reading:

• https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-metrics-and-dimensions.html