API Gateway REST API stage has logging enabled

Check ID: apigateway_restapi_logging_enabled
Provider: AWS
Service: apigateway
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: AwsApiGatewayStage

What this check verifies

API Gateway REST API stages with stage logging enabled to emit execution or access logs to CloudWatch

Risk

Without stage logging, API activity lacks visibility, hindering detection of abuse and incident response. Attackers can probe endpoints, exfiltrate data, or tamper integrations without traces, impacting confidentiality, integrity, and availability and blocking forensic investigation.

Recommendation

Enable CloudWatch Logs for all API Gateway stages, using ERROR or INFO as appropriate. Include request IDs (e.g., $context.requestId). Enforce least privilege on logs, set retention and alerts for anomalies. Avoid sensitive data in logs and use defense in depth with tracing.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws apigateway update-stage --rest-api-id <REST_API_ID> --stage-name <STAGE_NAME> --patch-operations op=replace,path='/*/*/logging/loglevel',value=ERROR

# Enable execution logging for all methods in a REST API stage
resource "aws_api_gateway_method_settings" "<example_resource_name>" {
  rest_api_id = "<example_resource_id>"
  stage_name  = "<example_resource_name>"
  method_path = "*/*"
  settings {
    logging_level = "ERROR"  # CRITICAL: enables stage execution logging
  }
}

# CloudFormation: enable execution logging on a REST API stage
Resources:
  <example_resource_name>:
    Type: AWS::ApiGateway::Stage
    Properties:
      StageName: <example_resource_name>
      RestApiId: <example_resource_id>
      DeploymentId: <example_resource_id>
      MethodSettings:
        - ResourcePath: "/*"
          HttpMethod: "*"
          LoggingLevel: ERROR  # CRITICAL: turns on execution logging for all methods

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigateway_restapi_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

API Gateway REST API stage has client certificate enabled API Gateway REST API endpoint is private

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires