Project: KICS (Provisioning / Security & Compliance)
File: 1b6799eb-4a7a-4b04-9001-8cceb9999326.md

title: API Gateway Access Logging Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1b6799eb-4a7a-4b04-9001-8cceb9999326 Query name: API Gateway Access Logging Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: API Gateway Stage should have Access Logging Settings defined<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 15" resource "awsapigateway_stage" "postive1" { stage_name = "dev" restapiid = "id" } resource "awsapigatewaymethodsettings" "all" { stagename = awsapigatewaystage.postive1.stage_name method_path = "/" settings { logging_level = "ERROR" } } resource "awsapigatewayv2stage" "postive2" { stage_name = "dev" restapiid = "id" defaultroutesettings { logging_level = "ERROR" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="28 15" resource "awsapigateway_stage" "postive1" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } } resource "awsapigatewaymethodsettings" "all" { stagename = awsapigatewaystage.postive1.stage_name method_path = "/" settings { logging_level = "" } } resource "awsapigatewayv2stage" "postive2" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } defaultroutesettings { logging_level = "" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="27 14" resource "awsapigateway_stage" "postive1" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } } resource "awsapigatewaymethodsettings" "all" { stagename = awsapigatewaystage.postive1.stage_name method_path = "/" settings { metrics_enabled = true } } resource "awsapigatewayv2stage" "postive2" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } defaultroutesettings { datatraceenabled = "true" } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="10 15" resource "awsapigateway_stage" "postive1" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } } resource "awsapigatewaymethodsettings" "all" { stagename = awsapigatewaystage.postive1.stage_name method_path = "/" } resource "awsapigatewayv2stage" "postive2" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="28 15" resource "awsapigateway_stage" "postive1" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } } resource "awsapigatewaymethodsettings" "all" { stagename = awsapigatewaystage.postive1.stage_name method_path = "/" settings { logging_level = "OFF" } } resource "awsapigatewayv2stage" "postive2" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } defaultroutesettings { logging_level = "OFF" } } ``` </details> <details><summary>Positive test num. 6 - tf file</summary> ```tf hl_lines="27 14" resource "awsapigateway_stage" "postive1" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } } resource "awsapigatewaymethodsettings" "all" { stagename = awsapigatewaystage.postive1.stage_name method_path = "/" settings { } } resource "awsapigatewayv2stage" "postive2" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } defaultroutesettings { } } ``` </details> <details><summary>Positive test num. 7 - tf file</summary> ```tf hl_lines="1" resource "awsapigateway_stage" "postive1" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awsapigateway_stage" "negative1" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } } resource "awsapigatewaymethodsettings" "all" { stagename = awsapigatewaystage.negative1.stage_name method_path = "/" settings { metrics_enabled = true logging_level = "ERROR" } } resource "awsapigatewayv2stage" "negative2" { stage_name = "dev" restapiid = "id" accesslogsettings { destination_arn = "dest" } defaultroutesettings { logging_level = "ERROR" } } ```