> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/ingest-aws-api-gateway.md).
# Ingest AWS API Gateway
Integrate AWS API Gateway with Cortex XSIAM to begin scanning the APIs for potential threats and vulnerabilities.
Settings in Cortex XSIAM
In Cortex XSIAM, set up the **AWS API Gateway** data source to integrate with the AWS API Gateway.
1. From **Settings** → **Data Sources** , click  and search for **AWS API Gateway** and then click **Connect** or **Connect Another Instance**.
2. In the **AWS API Collector** wizard, enter a relevant name and click **Create and Proceed**.
3. Copy the key and save it for later.
Note
You must generate a new key if you did not save.
4. Click **Close**.
Settings in AWS Management Console
Configure the settings in the AWS Management Console to integrate with Cortex XSIAM:
1. Log in to the [AWS Management Console](https://aws.amazon.com/console/).
2. In AWS Management Console, navigate to **API Gateway**.
1. Expand the left-hand menu of the API project.
2. Go to **Settings** → **Logging** and click **Edit**. Verify that the **CloudWatch log role ARN** is filled.
3. Click **Stages** and from **Stages**, select the relevant stage.
4. From **Logs and Tracing**, click **Edit** and configure the following:
* **CloudWatch Logs**: Select **Errors and info logs**
* Select **Data tracing**
* Select **Detailed metrics**
5. Click **Save**.
This creates a unique log group inside CloudWatch.
3. Open CloudWatch in another window by typing **CloudWatch** in the search bar.
1. Go to **Logs** → **Log groups** and search for the log group just created.
The group name follows the following format: `“API-Gateway-Execution-Logs_/”`
2. Click the log group, and from the **Log group details**, copy the **ARN**.
4. Return to **Edit logs and tracing**, go to **enable the custom access logging** , and paste the ARN without the \* in the **Access log destination ARN** field.
Example 45.
ARN: `arn:aws:logs:us-east-1:123456789012:log-group:API-Gateway-Execution-Logs_153tp249k2/Prod:*`
Paste in **Access log destination ARN**: `arn:aws:logs:us-east-1:123456789012:log-group:API-Gateway-Execution-Logs_153tp249k2/Prod`
5. In **Log format**, type the following and click **Save**:
```programlisting
($context.requestId) accountID: $context.accountId;
requestTimeMs: $context.requestTimeEpoch;
path: $context.path;
region: us-east-1;
apiID: $context.apiId;
stage: $context.stage;
extensionVersion: 1.0
```
6. Click **Create Firehose stream**.
1. Configure the following:
* **Source**: **Direct PUT**
* **Destination**: **HTTP Endpoint**
* **Firehose stream name**: Add a relevant name.
2. In **Destination settings**, configure the following:
* **HTTP endpoint URL** : Add the API URL from Cortex XSIAM.
* **Authentication**: Select **Use access key**.
* **Access key**: Paste the generated token from **AWS API Gateway**.
* **Content encoding**: Select **GZIP**.
3. In **Backup settings**, configure the following:
* **Source record backup in Amazon S3**: select **Failed date only**.
* **S3 backup bucket**: select a bucket or enter a bucket URI.
4. Click **Create**.
It takes up to 5 minutes for the stream to be activated.
7. Refer to [Subscription filters with Amazon Data Firehose](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html#FirehoseExample). To create an IAM Role and provide CloudWatch with the appropriate permissions for the streaming, refer to steps 8-11.
After the Data Firehose delivery stream is active and you have created the IAM role, you can create the CloudWatch Logs subscription filter. The subscription filter immediately starts the flow of real-time log data from the chosen log group to your Amazon Data Firehose delivery stream:
```programlisting
aws logs put-subscription-filter \
--log-group-name "" \
--filter-name "" \
--filter-pattern "" \
--destination-arn "arn:aws:firehose:region:123456789012:deliverystream/" \
--role-arn "arn:aws:iam:::role/"
```
Important
Leave –filter-pattern empty as displayed above.
After you create the filter, go back to **Data Sources** → **AWS API Gateway** to see the logs starting to come in.
Note
If no logs are showing, send some API requests on Postman or CURL.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/ingest-aws-api-gateway.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.