AWS AppSync has field-level logging disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_194
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform
Mapped CSPM/KSPM Rule	bffc2f87-93bd-44fe-b73a-be84220fa8eb

Impact

It is recommended to have a proper logging process for AWS AppSync in order to detect anomalous configuration activity. It is used to track configuration changes conducted manually and programmatically and trace back unapproved changes.

How to Fix

[source,go]

resource "aws_appsync_graphql_api" "all" { authentication_type = "API_KEY" name = "example"

log_config { cloudwatch_logs_role_arn = "aws_iam_role.example.arn" field_log_level = "ALL" } }