Installation

Before you begin

REST API gateway

To monitor the REST API gateway, complete the following:

1. Navigate to the console.aws.amazon.com/apigateway/.

2. Select the API and then select the stage.

3. Navigate to Logs/tracing.

4. Select Error and info logs from Cloudwatch Logs drop-down list.

5. Toggle Custom Access Logging to on, provide a log group arn for exporting the logs under Access log destination ARN and append the following JSON in Log Format:

{
  "requestId": "$context.requestId",
  "ip": "$context.identity.sourceIp",
  "httpMethod": "$context.httpMethod",
  "path": "$context.path",
  "status": "$context.status",
  "responseLength": "$context.responseLength",
  "domainName": "$context.domainName"
}

HTTP API gateway

To monitor the HTTP API gateway, enable access logging and append the JSON mentioned above in the Log Format.

Configure AWS

Configure AWS in your shell and verify that the region is set correctly. Enter the following command to set up your AWS CLI installation:

aws configure

The following example shows sample values. Replace them with your values to configure the credentials correctly.

$ aws configure
AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-west-2
Default output format [None]: json

For more information on the credentials file, see Configuration and credential file settings.

If you have configured named AWS profiles, export the environment variable AWS_PROFILE=myprofile where the profile named myprofile has the credentials that you wish to use to deploy the Traceable mirroring resources.

Finally, run the following command and verify that the AWS region is set to the region where you wish to install Traceable:

aws configure get region

Alternatively, you can configure the following environment variables:

AWS_ACCESS_KEY_ID

AWS_SECRET_ACCESS_KEY

AWS_REGION or AWS_DEFAULT_REGION

AWS_DEFAULT_OUTPUT

For more configuration information, see AWS documentation.

Multiple Accounts

A single AWS API Gateway account can support multiple accounts across different regions. However, each region within an account must be configured separately. This setup requires establishing cross-account IAM roles in each account, allowing the host account to authenticate and access the necessary resources. An IAM role can be created using the linked CloudFormation template. It takes a parameter account_id, in which the id of the account from which the monitoring is to be done is passed.

Deployment

Deployment via Console

1. Download the template tarball and untar it. The latest version of the template can be found in Traceable's Downloads site.

2. Search for CloudFormation in your AWS console and click CloudFormation.

3. Click on Create Stack.

4. In the Prerequisite—Prepare template section, Choose an existing template; in the Specify template section, select Upload a template file.

5. Specify a stack name and configure the various template file values.

6. Add tags, select rollback options, and configure additional settings as needed.

7. Review the settings and create the stack. Monitor the progress and ensure the stack is created successfully.

Deployment via CLI

1. Download the template tarball and untar it. The latest version of the template can be found in Traceable's Downloads site.

2. Create a parameters override json file with parameters that you want to override in the template. The json is of the format

   [
     {
       "ParameterKey": "<Parameter Name>",
       "ParameterValue": "<Parameter Value>"
     }
   ]

   A complete sample parameter file can be found here.

3. Run the following command to create the stack

aws cloudformation create-stack --stack-name <stack-name> --template-body </path/to/template> --parameters file://<path/to/parameters.json> --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM