Rule: API Gateway Stage Logging Enabled
Ensure API Gateway stage logging is enabled to meet compliance standards.
| Rule | API Gateway stage logging should be enabled |
| Framework | NIST Cybersecurity Framework (CSF) v1.1 |
| Severity | ✔ High |
Rule: API Gateway Stage Logging for NIST CSF v1
Description:
API Gateway is a service that enables you to create, publish, monitor, and secure APIs (Application Programming Interfaces) at any scale. Logging is an essential aspect of API Gateway, as it provides visibility into the API traffic, helps in monitoring and troubleshooting, and enhances security.
To align with the NIST Cybersecurity Framework (CSF) version 1, the logging feature in API Gateway must be enabled for each stage. This ensures that all API traffic and related activities are being logged, allowing for effective analysis and auditing of the system.
Troubleshooting Steps:
- 1.Verify that the API Gateway service is provisioned and available in your AWS account.
- 2.Access the API Gateway console or use the AWS Command Line Interface (CLI) to check the current configuration settings of your API.
- 3.Ensure that the stage(s) for your API are properly configured and associated with the desired logging settings.
- 4.Validate the permissions and access rights of the IAM role associated with the API Gateway stage logging.
Necessary Codes:
No specific codes are required for this rule. However, the AWS CLI commands mentioned in the remediation steps can be used for configuration updates.
Remediation Steps:
Follow these steps to enable API Gateway stage logging for NIST CSF v1:
- 1.Open the API Gateway console or access the AWS CLI.
- 2.Select the API you want to enable logging for.
- 3.Choose the desired stage for which logging needs to be enabled.
- 4.Under the "Logs/Tracing" tab, click on "Enable CloudWatch Logs" or "View CloudWatch Logs settings."
- 5.Configure the logging options according to your requirements, such as log format, log level, and retention period.
- 6.Click on "Enable" or "Save" to apply the changes.
Once the logging is enabled for the stage, API Gateway will start sending logs to CloudWatch Logs based on the chosen configuration. These logs can then be used for analysis, monitoring, and compliance purposes aligned with the NIST CSF v1.
Note: Make sure you have the necessary permissions to perform these actions in your AWS account.
For more information on enabling API Gateway stage logging, refer to the official AWS documentation.
Remember, enabling logging for API Gateway is an essential security practice that helps meet compliance requirements, enhance visibility, and improve the overall security posture of your API infrastructure.