API Gateway does not have access logging enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_76
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Enabling the custom access logging option in API Gateway allows delivery of custom logs to CloudWatch Logs, which can be analyzed using CloudWatch Logs Insights. Using custom domain names in Amazon API Gateway allows insights into requests sent to each custom domain name. If there is more than one custom domain name mapped to a single API, understanding the quantity and type of requests by domain name may help understand request patterns.

How to Fix

Resource: AWS::ApiGateway::Stage

• Arguments: Properties.AccessLogSettings.DestinationArn [source,go]

---

Resources: MyStage: Type: AWS::ApiGateway::Stage Properties: ... AccessLogSetting: DestinationArn: 'arn:aws:logs:us-east-1:123456789:log-group:example-log-group' Format: "..." ...