Api Gateway Stage Logging Enabled Rule

Rule Description:

Troubleshooting Steps:

2. 1.
   Validate IAM permissions: Ensure that the user or role associated with the API Gateway has the required IAM permissions to enable logging for the stage.
4. 2.
   Confirm API Gateway configuration: Double-check that the API Gateway resource is correctly configured, and the associated stage is properly set up.
6. 3.
   Verify CloudWatch Logs integration: Ensure that the API Gateway is integrated with CloudWatch Logs for storing the logs.

Necessary Codes:

2. 1.
   Enable detailed CloudWatch logging for the stage:

aws apigateway update-stage \
    --rest-api-id <API-ID> \
    --stage-name <STAGE-NAME> \
    --patch-operations '[{"op":"replace","path":"/accessLogSettings/destinationArn","value":"arn:aws:logs:<REGION>:<ACCOUNT-ID>:log-group:<LOG-GROUP-NAME>"}]'

<API-ID>

<STAGE-NAME>

<REGION>

<ACCOUNT-ID>

<LOG-GROUP-NAME>

2. 1.
   Enable logging for each method:

aws apigateway update-stage \
    --rest-api-id <API-ID> \
    --stage-name <STAGE-NAME> \
    --patch-operations '[{"op":"replace","path":"/accessLogSettings/format","value":"json"},{"op":"add","path":"/accessLogSettings/roleArn","value":"arn:aws:iam::<ACCOUNT-ID>:role/<ROLE-NAME>"}]'

<API-ID>

<STAGE-NAME>

<ACCOUNT-ID>

<ROLE-NAME>

Step-by-Step Guide for Remediation:

2. 1.
   Authenticate to the AWS Management Console.
4. 2.
   Go to the API Gateway service page.
6. 3.
   Select the desired API from the list.
8. 4.
   Choose the correct Stage from the left-hand menu.
10. 5.
    Click on the Logs/Tracing tab.
12. 6.
    In the Access Logging section, click on Edit.
14. 7.
    Enable the switch next to Enable Access Logging.
16. 8.
    Enter the ARN of the desired CloudWatch Logs group in the CloudWatch Logs group ARN field.
18. 9.
    Save the changes.
20. 10.
    Repeat steps 6-9 for each method within the stage, if necessary.
22. 11.
    Verify that the logging is functioning correctly by accessing the API and checking if logs are being generated in the specified CloudWatch Logs group.