Control: 9 Access logging should be configured for API Gateway V2 Stages
Description
This control checks if Amazon API Gateway V2 stages have access logging configured. This control fails if access log settings aren't defined.
API Gateway access logs provide detailed information about who has accessed your API and how the caller accessed the API. These logs are useful for applications such as security and access audits and forensics investigation. Enable these access logs to analyze traffic patterns and to troubleshoot issues.
For additional best practices, see Monitoring REST APIs in the API Gateway Developer Guide.
Remediation
To set up access logging, see Set up CloudWatch API logging using the API Gateway console in the API Gateway Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_apigateway_9Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_apigateway_9 --shareSQL
This control uses a named query:
select 'arn:' || partition || ':apigateway:' || region || '::/apis/' || api_id || '/stages/' || stage_name as resource, case when access_log_settings is null then 'alarm' else 'ok' end as status, case when access_log_settings is null then title || ' access logging disabled.' else title || ' access logging enabled.' end as reason , region, account_idfrom aws_api_gatewayv2_stage;