HIPAA Security - Implement api-gw-xray-enabled config rule

[dontirun]

Summary

As a developer

I would like to implement the api-gw-xray-enabled config rule

So that I can check if qualified resources in my CDK app conforms to the following HIPAA Security control(s): 164.312(b)

Details

ruleId: HIPAA.Security-APIGWXRayEnabled

info: The API Gateway stage is not have X-Ray tracing enabled - (Control IDs: 164.312(b))

Given Reason: AWS X-Ray collects data about requests that your application serves, and provides tools you can use to view, filter, and gain insights into that data to identify issues and opportunities for optimization. Ensure X-Ray is enables so you can see detailed information not only about the request and response, but also about calls that your application makes to downstream AWS resources, microservices, databases and HTTP web APIs.

Acceptance Criteria

If the rule can be implemented

Given a CDK app with a non-compliant resource

• When HIPAA Security Pack is enabled
• Then the CDK stack does not deploy and the user receives an ERROR with relevant Control ID information about the non compliant resource

Given a CDK app with a compliant resource

• When HIPAA Security Pack is enabled
• Then the CDK stack deploys and the user does not receive an ERROR about the compliant resource

Given the cdk-nag RULES file

• When the HIPAA.Security-APIGWXRayEnabled rule is added to the rule pack
• Then the HIPAA Security Errors section is updated with the rule information

If the rule cannot be implemented

Given the cdk-nag RULES file

• When the api-gw-xray-enabled check is not added to the rule pack
• Then the HIPAA Security Excluded Rules section is updated with the check information