AWS AppSync's logging is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_193
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform

Impact

This rule ensures that AWS AppSync GraphQL APIs have logging enabled. Enabling logging for AppSync allows you to capture, store, and analyze the API activity, which is crucial for monitoring, troubleshooting, and ensuring the security of your API. This rule checks whether the CloudWatchLogsRoleArn property in the LogConfig configuration is set to a valid value.

How to Fix

To fix this issue, ensure that the CloudWatchLogsRoleArn property in the LogConfig configuration of the AWS::AppSync::GraphQLApi resource is set to a valid IAM role ARN that grants permission to write logs to CloudWatch.

Example: [source,go]

Resources: MyAppSyncGraphQLApi: Type: AWS::AppSync::GraphQLApi Properties: Name: example-api AuthenticationType: API_KEY LogConfig: CloudWatchLogsRoleArn: arn:aws:iam::123456789012:role/appsync-logging-role FieldLogLevel: ALL ...