Description

Ensure that API Gateway V2 (HTTP API or WebSocket API) stages have access logging enabled and delivered to Amazon CloudWatch Logs, so that a record of each request, including caller identity, route, status code, and latency, is retained.

Rationale

HTTP APIs and WebSocket APIs built on API Gateway V2 do not log request details by default, which limits visibility into traffic patterns, error rates, and potentially abusive or anomalous access. Enabling access logging with an appropriate log format ensures that request-level details are retained for operational monitoring and security investigation.

Impact

  • Provides request-level visibility for HTTP and WebSocket APIs

  • Supports troubleshooting, usage analysis, and security investigations

  • Increases CloudWatch Logs storage cost proportional to API traffic volume

Default Value

Access logging is disabled by default for API Gateway V2 (HTTP API and WebSocket API) stages.

Pre-Requisites

  • A destination CloudWatch Logs log group

  • IAM permissions for API Gateway to write to CloudWatch Logs, and to update stage settings (apigateway:PATCH)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the HTTP API or WebSocket API to review.

  3. Select Stages, then select the stage to review.

  4. Open the Logging tab.

  5. Verify that Access logging is enabled with a destination CloudWatch Logs group and an appropriate log format defined.

  6. If access logging is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the HTTP or WebSocket API to update.

  3. Select Stages, then select the stage to update.

  4. Open the Logging tab and select Edit.

  5. Enable Access logging, select or create a destination CloudWatch Logs log group, and define the log format (JSON is recommended for structured querying).

  6. Save the changes.

  7. Verify log entries begin appearing in the specified log group after subsequent API calls.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to API Gateway and select the HTTP or WebSocket API to update.

  3. Select Stages, then select the affected stage.

  4. Open the Logging tab and select Edit.

  5. Disable Access logging.

  6. Save the changes.

Reference