Description

Ensure that API Gateway REST API stages have execution logging (and optionally access logging) enabled and sent to Amazon CloudWatch Logs, so that request and error details are captured for monitoring, troubleshooting, and security analysis.

Rationale

Without logging enabled, there is no record of API requests, responses, errors, or the identities making calls, which severely limits the ability to detect abuse, diagnose failures, or perform forensic analysis after a security incident. Enabling CloudWatch Logs for the stage, at an appropriate logging level, provides visibility into API activity necessary for both operational and security purposes.

Impact

  • Provides visibility into API requests, errors, and latency for troubleshooting and monitoring

  • Supports security investigations by recording caller and request details

  • Increases CloudWatch Logs storage cost proportional to API traffic volume

Default Value

Execution logging and access logging are disabled by default for a newly created API Gateway REST API stage.

Pre-Requisites

  • An IAM role for API Gateway to write to CloudWatch Logs, configured account-wide in API Gateway settings

  • IAM permissions to update stage logging settings (apigateway:PATCH)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the REST API to review.

  3. Select Stages, then select the stage to review.

  4. Open the Logs/Tracing tab.

  5. Verify that CloudWatch Logs is enabled with an appropriate Log level (Error, or Error and Info), and that a destination Log group is configured.

  6. If access logging is required, verify Access logging is also enabled with a destination log group and format configured.

  7. If logging is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway > Settings and ensure a CloudWatch Logs role ARN is configured account-wide, if not already set.

  3. Navigate to the REST API to update, select Stages, then select the stage to update.

  4. Open the Logs/Tracing tab and select Edit.

  5. Enable CloudWatch Logs and set the desired Log level (Error, or Error and Info).

  6. Enable Access logging, select or create a destination CloudWatch Logs group, and define the log format.

  7. Save the changes and verify log entries begin appearing in the specified log group after subsequent API calls.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the REST API to update.

  3. Select Stages, then select the affected stage.

  4. Open the Logs/Tracing tab and select Edit.

  5. Disable CloudWatch Logs and/or Access logging.

  6. Save the changes.



Reference