# Ensure API Gateway V2 API Stage Has Access Logging Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890018632763-ensure-api-gateway-v2-api-stage-has-access-logging-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that API Gateway V2 (HTTP API or WebSocket API) stages have access logging enabled and delivered to Amazon CloudWatch Logs, so that a record of each request, including caller identity, route, status code, and latency, is retained.

**Rationale**

HTTP APIs and WebSocket APIs built on API Gateway V2 do not log request details by default, which limits visibility into traffic patterns, error rates, and potentially abusive or anomalous access. Enabling access logging with an appropriate log format ensures that request-level details are retained for operational monitoring and security investigation.

**Impact**

-   Provides request-level visibility for HTTP and WebSocket APIs
    
-   Supports troubleshooting, usage analysis, and security investigations
    
-   Increases CloudWatch Logs storage cost proportional to API traffic volume
    

**Default Value**

Access logging is disabled by default for API Gateway V2 (HTTP API and WebSocket API) stages.

**Pre-Requisites**

-   A destination CloudWatch Logs log group
    
-   IAM permissions for API Gateway to write to CloudWatch Logs, and to update stage settings (apigateway:PATCH)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to API Gateway and select the HTTP API or WebSocket API to review.
    
3.  Select Stages, then select the stage to review.
    
4.  Open the Logging tab.
    
5.  Verify that Access logging is enabled with a destination CloudWatch Logs group and an appropriate log format defined.
    
6.  If access logging is disabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to API Gateway and select the HTTP or WebSocket API to update.
    
3.  Select Stages, then select the stage to update.
    
4.  Open the Logging tab and select Edit.
    
5.  Enable Access logging, select or create a destination CloudWatch Logs log group, and define the log format (JSON is recommended for structured querying).
    
6.  Save the changes.
    
7.  Verify log entries begin appearing in the specified log group after subsequent API calls.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to API Gateway and select the HTTP or WebSocket API to update.
    
3.  Select Stages, then select the affected stage.
    
4.  Open the Logging tab and select Edit.
    
5.  Disable Access logging.
    
6.  Save the changes.
    

**Reference**

-   [https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-logging.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-logging.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.