📝 AWS API Gateway API Execution Logging in CloudWatch is not enabled 🟢

• Contextual name: 📝 API Execution Logging in CloudWatch is not enabled 🟢
• ID: /ce/ca/aws/apigateway/api-execution-logging
• Located in: 📁 AWS API Gateway

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • PERFORMANCE
  • RELIABILITY

Similar Policies

• Internal
  • dec-x-2ac6c302

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-2ac6c302	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 AWS API Gateway API
  • 🔌 AWS API Gateway Stage - object.extracts.yaml
  • 🔌 AWS API Gateway API - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

AWS API Gateway should have API Execution Logging enabled in CloudWatch to support effective monitoring and troubleshooting. Enabling execution logging in CloudWatch provides insight into API requests, error rates, and latency, helping detect and respond to issues promptly.

Rationale

Enabling API execution logging in CloudWatch helps monitor API usage and performance, as well as identify and troubleshoot issues in real-time. It enhances visibility into API traffic patterns, execution errors, and latencies, facilitating better management of APIs.

Impact

Enabling CloudWatch logging may increase CloudWatch costs due to additional logging data.

Audit

This policy will mark an AWS API Gateway API as INCOMPLIANT if the CloudWatch Logging Level field in a related API Stage object is either empty or set to OFF.

For API Gateway HTTP APIs (identified by the Protocol Type field set to HTTP), the policy object will be marked as INAPPLICABLE because HTTP APIs do not support execution logging.

Remediation

Open File

Remediation

Prerequisites

To enable CloudWatch Logs, grant API Gateway permission to read and write logs to CloudWatch in your account. The managed policy AmazonAPIGatewayPushToCloudWatchLogs (ARN: arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs) provides the necessary permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:PutLogEvents",
                "logs:GetLogEvents",
                "logs:FilterLogEvents"
            ],
            "Resource": "*"
        }
    ]
}

To set up these permissions:

1. Create an IAM role with apigateway.amazonaws.com as the trusted entity.
2. Attach the above policy to the IAM role.
3. Set the IAM role ARN in the cloudWatchRoleArn property of your Account. Note that you must configure the cloudWatchRoleArn separately for each AWS Region where you wish to enable CloudWatch Logs.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;		18	21
💼 APRA CPG 234 → 💼 h. audit logging and monitoring of access to information assets by all users;		7	8
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [APIGateway.1] API Gateway REST and WebSocket API execution logging should be enabled		1	1
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			49
💼 FedRAMP High Security Controls → 💼 AU-2 Event Logging (L)(M)(H)			6
💼 FedRAMP High Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)	1		20
💼 FedRAMP High Security Controls → 💼 AU-6(3) Correlate Audit Record Repositories (M)(H)			6
💼 FedRAMP High Security Controls → 💼 AU-6(4) Central Review and Analysis (H)			6
💼 FedRAMP High Security Controls → 💼 AU-10 Non-repudiation (H)			5
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		47
💼 FedRAMP High Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)	2		8
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)		46	48
💼 FedRAMP Low Security Controls → 💼 AU-2 Event Logging (L)(M)(H)			6
💼 FedRAMP Low Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)			6
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Low Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)	1		8
💼 FedRAMP Moderate Security Controls → 💼 AU-2 Event Logging (L)(M)(H)			6
💼 FedRAMP Moderate Security Controls → 💼 AU-3 Content of Audit Records (L)(M)(H)	1		20
💼 FedRAMP Moderate Security Controls → 💼 AU-6(3) Correlate Audit Record Repositories (M)(H)			6
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 CA-7 Continuous Monitoring (L)(M)(H)	2		8
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities			26
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources			26
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			83
💼 NIST CSF v2.0 → 💼 DE.CM-02: The physical environment is monitored to find potentially adverse events			8
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			59
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events			27
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations			10
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties			23
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities			24
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded			22
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked			24
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(26) Information Flow Enforcement _ Audit Filtering Actions			7
💼 NIST SP 800-53 Revision 5 → 💼 AU-2 Event Logging	4		6
💼 NIST SP 800-53 Revision 5 → 💼 AU-3 Content of Audit Records	3	13	20
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(3) Audit Record Review, Analysis, and Reporting _ Correlate Audit Record Repositories			6
💼 NIST SP 800-53 Revision 5 → 💼 AU-6(4) Audit Record Review, Analysis, and Reporting _ Central Review and Analysis			6
💼 NIST SP 800-53 Revision 5 → 💼 AU-10 Non-repudiation	5		5
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	45	47
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring	6		8
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic			7
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(8) Software, Firmware, and Information Integrity _ Auditing Capability for Significant Events			6