Project: KICS (Provisioning / Security & Compliance)
File: 80d45af4-4920-4236-a56e-b7ef419d1941.md

title: API Gateway V2 Stage Access Logging Settings Not Defined hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 80d45af4-4920-4236-a56e-b7ef419d1941 Query name: API Gateway V2 Stage Access Logging Settings Not Defined Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: API Gateway Stage should have Access Logging Settings defined<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="16" Resources: Prod: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage AccessLogSetting: DestinationArn: "dest" Format: "format" RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" ClientCertificateId: "" Variables: Stack: Prod MethodSettings: ResourcePath: / HttpMethod: GET MetricsEnabled: false DataTraceEnabled: false ResourcePath: /stack HttpMethod: POST MetricsEnabled: false DataTraceEnabled: false ResourcePath: /stack HttpMethod: GET MetricsEnabled: true DataTraceEnabled: false ``` ```json title="Positive test num. 2 - json file" hl_lines="19" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "MyStage": { "Type": "AWS::ApiGateway::Stage", "Properties": { "StageName": "Prod", "Description": "Prod Stage", "AccessLogSetting": { "DestinationArn": "dest", "Format": "format" }, "DeploymentId": { "Ref": "MyDeployment" }, "RestApiId": { "Ref": "CFNWebSocket" }, "MethodSettings": { } } } } } ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="4 13" Resources: Prod: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage AccessLogSetting: DestinationArn: "dest" Format: "format" RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" MethodSettings: ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="21" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "MyStage": { "Type": "AWS::ApiGateway::Stage", "Properties": { "StageName": "Prod", "Description": "Prod Stage", "AccessLogSetting": { "DestinationArn": "dest", "Format": "format" }, "DeploymentId": { "Ref": "MyDeployment" }, "RestApiId": { "Ref": "CFNWebSocket" }, "MethodSettings": { "DetailedMetricsEnabled": true, "LoggingLevel": "OFF", "DataTraceEnabled": false, "ThrottlingBurstLimit": 10, "ThrottlingRateLimit": 10 } } } } } ``` </details> <details><summary>Positive test num. 5 - yaml file</summary> ```yaml hl_lines="4 14" Resources: Prod: Type: AWS::ApiGatewayV2::Stage Properties: StageName: Prod Description: Prod Stage AccessLogSettings: DestinationArn: "dest" Format: "format" RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" ApiId: "teste" DefaultRouteSettings: ``` </details> <details><summary>Positive test num. 6 - yaml file</summary> ```yaml hl_lines="14" Resources: Prod: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage AccessLogSetting: DestinationArn: "dest" Format: "format" RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" MethodSettings: LoggingLevel: "OFF" ``` </details> <details><summary>Positive test num. 7 - yaml file</summary> ```yaml hl_lines="15" Resources: Prod: Type: AWS::ApiGatewayV2::Stage Properties: StageName: Prod Description: Prod Stage AccessLogSettings: DestinationArn: "dest" Format: "format" RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" ApiId: "teste" DefaultRouteSettings: LoggingLevel: "OFF" ``` </details> <details><summary>Positive test num. 8 - yaml file</summary> ```yaml hl_lines="4" Resources: Prod: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" MethodSettings: LoggingLevel: "ON" ``` </details> <details><summary>Positive test num. 9 - yaml file</summary> ```yaml hl_lines="4" Resources: Prod: Type: AWS::ApiGatewayV2::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" ApiId: "teste" DefaultRouteSettings: LoggingLevel: "ON" ``` </details> <details><summary>Positive test num. 10 - json file</summary> ```json hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Router53", "Resources": { "MyStage": { "Type": "AWS::ApiGatewayV2::Stage", "Properties": { "Description": "Prod Stage", "AccessLogSettings": { "DestinationArn": "dest", "Format": "format" }, "DeploymentId": "MyDeployment", "ApiId": "CFNWebSocket", "StageName": "Prod" } } } } ``` </details> <details><summary>Positive test

11 - json file</summary> ```json hl_lines="21" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "MyStage": { "Type": "AWS::ApiGatewayV2::Stage", "Properties": { "StageName": "Prod", "Description": "Prod Stage", "AccessLogSettings": { "DestinationArn": "dest", "Format": "format" }, "DeploymentId": { "Ref": "MyDeployment" }, "ApiId": { "Ref": "CFNWebSocket" }, "DefaultRouteSettings": { "DetailedMetricsEnabled": true, "LoggingLevel": "OFF", "DataTraceEnabled": false, "ThrottlingBurstLimit": 10, "ThrottlingRateLimit": 10 } } } } } ``` </details> <details><summary>Positive test num. 12 - json file</summary> ```json hl_lines="19" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "MyStage": { "Type": "AWS::ApiGatewayV2::Stage", "Properties": { "StageName": "Prod", "Description": "Prod Stage", "AccessLogSettings": { "DestinationArn": "dest", "Format": "format" }, "DeploymentId": { "Ref": "MyDeployment" }, "ApiId": { "Ref": "CFNWebSocket" }, "DefaultRouteSettings": { "DetailedMetricsEnabled": true, "DataTraceEnabled": false, "ThrottlingBurstLimit": 10, "ThrottlingRateLimit": 10 } } } } } ``` </details> <details><summary>Positive test num. 13 - json file</summary> ```json hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "MyStage": { "Type": "AWS::ApiGatewayV2::Stage", "Properties": { "StageName": "Prod", "Description": "Prod Stage", "DeploymentId": { "Ref": "MyDeployment" }, "ApiId": { "Ref": "CFNWebSocket" }, "DefaultRouteSettings": { "DetailedMetricsEnabled": true, "LoggingLevel": "INFO", "DataTraceEnabled": false, "ThrottlingBurstLimit": 10, "ThrottlingRateLimit": 10 } } } } } ``` </details> <details><summary>Positive test num. 14 - json file</summary> ```json hl_lines="6" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "MyStage": { "Type": "AWS::ApiGateway::Stage", "Properties": { "StageName": "Prod", "Description": "Prod Stage", "DeploymentId": { "Ref": "MyDeployment" }, "MethodSettings": { "DetailedMetricsEnabled": true, "LoggingLevel": "INFO", "DataTraceEnabled": false, "ThrottlingBurstLimit": 10, "ThrottlingRateLimit": 10 }, "RestApiId": { "Ref": "CFNWebSocket" } } } } } ``` </details> <details><summary>Positive test num. 15 - json file</summary> ```json hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "Router53", "Resources": { "MyStage": { "Type": "AWS::ApiGateway::Stage", "Properties": { "Description": "Prod Stage", "AccessLogSetting": { "DestinationArn": "dest", "Format": "format" }, "DeploymentId": "MyDeployment", "RestApiId": "CFNWebSocket", "StageName": "Prod" } } } } ``` </details> <details><summary>Positive test num. 16 - yaml file</summary> ```yaml hl_lines="4" Resources: Prod: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage AccessLogSetting: DestinationArn: "dest" Format: "format" RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" ``` </details> <details><summary>Positive test num. 17 - yaml file</summary> ```yaml hl_lines="4" Resources: Prod: Type: AWS::ApiGatewayV2::Stage Properties: StageName: Prod Description: Prod Stage AccessLogSettings: DestinationArn: "dest" Format: "format" RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" ApiId: "teste" ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: "Router53" Resources: MyStage: Type: 'AWS::ApiGatewayV2::Stage' Properties: StageName: Prod Description: Prod Stage DeploymentId: !Ref MyDeployment ApiId: !Ref CFNWebSocket DefaultRouteSettings: DetailedMetricsEnabled: true LoggingLevel: INFO DataTraceEnabled: false ThrottlingBurstLimit: 10 ThrottlingRateLimit: 10 AccessLogSettings: DestinationArn: 'arn:aws:logs:us-east-1:123456789:log-group:my-log-group' Format: >- {"requestId":"$context.requestId", "ip": "$context.identity.sourceIp", "caller":"$context.identity.caller", "user":"$context.identity.user","requestTime":"$context.requestTime", "eventType":"$context.eventType","routeKey":"$context.routeKey", "status":"$context.status","connectionId":"$context.connectionId"} ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MyStage": { "Type": "AWS::ApiGatewayV2::Stage", "Properties": { "StageName": "Prod", "Description": "Prod Stage", "DeploymentId": "MyDeployment", "ApiId": "CFNWebSocket", "DefaultRouteSettings": { "DetailedMetricsEnabled": true, "LoggingLevel": "INFO", "DataTraceEnabled": false, "ThrottlingBurstLimit": 10, "ThrottlingRateLimit": 10 }, "AccessLogSettings": { "DestinationArn": "arn:aws:logs:us-east-1:123456789:log-group:my-log-group", "Format": "{\"requestId\":\"$context.requestId\", \"ip\": \"$context.identity.sourceIp\", \"caller\":\"$context.identity.caller\", \"user\":\"$context.identity.user\",\"requestTime\":\"$context.requestTime\", \"eventType\":\"$context.eventType\",\"routeKey\":\"$context.routeKey\", \"status\":\"$context.status\",\"connectionId\":\"$context.connectionId\"}" } } } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "Router53" } ``` ```json title="Negative test num. 3 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "MyStage": { "Type": "AWS::ApiGateway::Stage", "Properties": { "StageName": "Prod", "Description": "Prod Stage", "AccessLogSetting": { "DestinationArn": "dest", "Format": "format" }, "DeploymentId": { "Ref": "MyDeployment" }, "MethodSettings": { "DetailedMetricsEnabled": true, "LoggingLevel": "INFO", "DataTraceEnabled": false, "ThrottlingBurstLimit": 10, "ThrottlingRateLimit": 10 }, "RestApiId": { "Ref": "CFNWebSocket" } } } } } ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml Resources: Prod: Type: AWS::ApiGateway::Stage Properties: StageName: Prod Description: Prod Stage RestApiId: !Ref MyRestApi DeploymentId: !Ref TestDeployment DocumentationVersion: "" MethodSettings: LoggingLevel: "ON" AccessLogSetting: DestinationArn: "dest" Format: "format" ``` </details>