Enable X-Ray Tracing or WAF

[SatinderSidhu]

Description

X-Ray Tracing or WAF is not enabled by default when AGC deploys API Gateway for every context,

Use Case

As Security is job Zero, the API Gateway is mostly protected with companies by X-Ray tracing or attaching WAF to it & its enforced with AWS Config. Now when AGC deploys API Gateway for every context, AGC currently doesn’t enable X-ray tracing or WAF. So they start seeing the compliance issues.

Proposed Solution

Enable X-Ray & WAF ACL for every context by default when API gateway is deployed.

Other information

. These could be manually enabled by the customer as a work around but it will have to be done for every context the users deploy

[markjschreiber]

X-Ray is not really a security product but can be useful for performing debugging or optimization of API calls and distributed systems. This seems more like a developer option rather than something a customer would use? What would be the use case?

WAF could be enabled but it would need to be accompanied by WAF rules to be useful. What kind of WAF rules would you want included?