Data Trace is not enabled in the API Gateway Method Settings misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_276
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

This rule verifies that Data Trace is not enabled in the settings for API Gateway Methods on AWS. If Data Trace is enabled, it could pose a security risk as it allows verbose logging of all data between the client and server. This includes potentially sensitive information like API keys and personal data. Enabling Data Trace can also incur unnecessary costs and hamper performance due to increased logging activities, making it desirable to keep it off.

How to Fix

Resource: aws_api_gateway_method_settings

• Arguments: settings.data_trace_enabled

To fix this issue, you need to ensure that 'dataTraceEnabled' is set to false in your AWS API Gateway Method Settings. The dataTraceEnabled field provides detailed information about request or response HTTP headers, status codes, and timings which can be very information-intensive. Therefore, it's recommended to disable it so as to not overload your system with too much data.

The above code is considered secure because it explicitly sets 'dataTraceEnabled' to false in AWS API Gateway Method Settings. This ensures that no extensive, potentially overwhelming, data is traced and logged. [source,go]

resource "aws_api_gateway_method_settings" "example" { rest_api_id = aws_api_gateway_rest_api.example.id stage_name = aws_api_gateway_deployment.example.stage_name method_path = "/"

settings { metrics_enabled = false logging_level = "OFF" data_trace_enabled = false } }