Control: AppSync graphql API logging should be enabled
Description
This control checks whether an AWS AppSync API has field-level logging turned on. The control fails if the field resolver log level is set to None. Unless you provide custom parameter values to indicate that a specific log type should be enabled, Security Hub produces a passed finding if the field resolver log level is either ERROR or ALL.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.appsync_graphql_api_field_level_logging_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.appsync_graphql_api_field_level_logging_enabled --shareSQL
This control uses a named query:
appsync_graphql_api_field_level_logging_enabled