Rule: API Gateway Stage Logging Should Be Enabled

API Gateway Stage Logging for NIST 800-53 Revision 5

Description

Troubleshooting Steps

2. 1.
   Check Logging Configuration: Verify that the API Gateway stage logging is enabled in the AWS Management Console or using the AWS CLI. Ensure that the appropriate log destination, such as Amazon CloudWatch Logs, has been configured.
4. 2.
   Check IAM Permissions: Ensure that the IAM roles or users associated with the API Gateway have the necessary permissions to write logs to the configured log destination. You can review and modify IAM policies to grant the required permissions.
6. 3.
   Check API Gateway Stage Settings: Validate that the API Gateway stage is correctly configured to send logs to the desired log destination. Double-check the settings related to logging options and verify that they match your intended configuration.
8. 4.
   Check CloudWatch Logs: If you are using CloudWatch Logs as the log destination, ensure that the log group and log stream are correctly set up. Check if the log group and stream have any issues or if they are reaching their storage limits.
10. 5.
    Review CloudTrail: If you utilize AWS CloudTrail to monitor API Gateway events, review the CloudTrail logs to identify any potential errors or issues related to stage logging.

Necessary Codes

AWS CLI Command to Enable Stage Logging

aws apigateway update-stage \
    --rest-api-id <API_ID> \
    --stage-name <STAGE_NAME> \
    --patch-operations op=replace,path=/accessLogSettings/destinationArn,value=<DESTINATION_ARN>

<API_ID>

<STAGE_NAME>

<DESTINATION_ARN>

AWS CLI Command to Grant Logging Permissions

aws iam attach-role-policy \
    --role-name <ROLE_NAME> \
    --policy-arn <POLICY_ARN>

<ROLE_NAME>

<POLICY_ARN>

Remediation Steps

2. 1.
   Open the AWS Management Console and navigate to the Amazon API Gateway service.
4. 2.
   Select the desired API from the API list.
6. 3.
   In the left-hand sidebar, click on the "Stages" option.
8. 4.
   Locate and select the specific stage for which you want to enable logging.
10. 5.
    Click on the "Logs/Tracing" tab at the top of the stage configuration page.
12. 6.
    Under the "Access Logs" section, click the "Edit" button.
14. 7.
    Enable the toggle switch to turn on logging for the stage.
16. 8.
    Choose the desired log destination, such as CloudWatch Logs, from the "CloudWatch Logs" dropdown menu.
18. 9.
    Enter the ARN of the log destination in the provided field (e.g., ARN of the CloudWatch Logs log group).
20. 10.
    Click "Save" to save the changes and enable stage logging.