aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::ApiGateway::Stage MethodSetting.DataTraceEnabled should not be used in production

Open
#984 1 comment 0 reactions 0 assignees View on GitHub
documentation
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::ApiGateway::Stage

### Resource name

_No response_

### Reference Link

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-stage-methodsetting.html#cfn-apigateway-stage-methodsetting-datatraceenabled

### Details

The `MethodSetting.DataTraceEnabled` flag actually maps to the "Log full requests/responses data" checkbox in the console, which is not at all obvious. Furthermore, the console docs specifically mention this options should not be enabled in production. This warning ought to be added to the CloudFormation documentation.

https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html

> This can be useful to troubleshoot APIs, but can result in logging sensitive data. We recommend that you don't enable Log full requests/responses data for production APIs.

Contributor guide

Open the contributing guide

Research direction

Start with the linked AWS CloudFormation MethodSetting.DataTraceEnabled reference and the API Gateway logging guidance. Update the property documentation to explain that it enables full request and response logging, clarify the console checkbox mapping, and include the warning against enabling it for production APIs.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
documentation
Issue type
Documentation
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.