A solutions architect needs to ensure that only authorized AWS users or roles can call a new Amazon API Gateway endpoint. The architect also wants an end‑to‑end trace of each request to measure latency and build service maps. How can API Gateway access control and request tracing be implemented to satisfy both requirements?

Setting API Gateway method authorization to AWSIAM directly leverages AWS Identity and Access Management (IAM) for access control, ensuring only authorized AWS users or roles can invoke the API. Granting execute-api:Invoke permission on the REST API resource is the specific IAM action required. Requiring API clients to sign requests with AWS Signature ensures that requests are authenticated using AWS credentials. AWS X-Ray is the appropriate service for end-to-end tracing, allowing for latency measurement and service map generation across distributed applications, including API Gateway. Incorrect options: Enabling CORS is for cross-origin resource sharing, not for authenticating AWS users or roles. CloudWatch can log API Gateway requests but does not provide end-to-end tracing or service maps like X-Ray. A custom Lambda authorizer can control access but is not the most direct or native way to authorize AWS IAM users/roles, which AWSIAM authorization handles efficiently. Client certificates provide mutual TLS authentication but are not designed for authorizing specific AWS IAM users or roles. Again, CloudWatch lacks X-Ray's tracing capabilities.