Q:

Logging TLS Version

As per https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html it is possible to restrict aws api gateway to a particular version of TLS.  Rather than just change this, I'm keen to log any existing connections that are being established over TLS 1.0 or 1.1 in order to identify and fix those apps generating insecure connections.  Does anyone know if it's possible to have the service log this? 

A:

There is not currently a way to log this in API Gateway logging but it sounds like a good feature request.  I'd recommend submitting this request in the forums if you can as the community there may make enough noise to push the feature request quicker. 
I see that access logs allow you to log any context variable so I think the best feature request would be to ask for a context variable containing the negotiated TLS version so it can be logged, or for it to be logged by default in the execution logs when full request/response data is enabled for CloudWatch logging.