API Gateway V2 API stage has access logging enabled

Check ID: apigatewayv2_api_access_logging_enabled
Provider: AWS
Service: apigatewayv2
Severity: MEDIUM
Categories: logging
Resource type: AwsApiGatewayV2Stage

What this check verifies

API Gateway v2 stages have access logging configured to capture request details and deliver them to a logging destination (e.g., CloudWatch Logs or Firehose). The evaluation looks for logging being enabled at each API stage.

Risk

Without access logs, API calls lack traceability, making it hard to spot credential misuse, route abuse, or anomalous traffic. This reduces confidentiality and integrity through undetected data access or manipulation, and impacts availability by slowing incident response.

Recommendation

Enable stage-level access logging to a centralized destination and use structured formats. Apply appropriate retention and restrict log access per least privilege. Integrate logs with monitoring and alerts to detect anomalies, and complement with defense in depth controls.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws apigatewayv2 update-stage --api-id <API_ID> --stage-name <STAGE_NAME> --access-log-settings DestinationArn=<LOG_GROUP_ARN>,Format='{"requestId":"$context.requestId"}'

# Terraform: Enable access logging on API Gateway V2 stage
resource "aws_apigatewayv2_stage" "<example_resource_name>" {
  api_id = "<example_resource_id>"
  name   = "<example_resource_name>"

  access_log_settings { # Critical: enables access logging for the stage
    destination_arn = "<example_log_group_arn>"
    format          = "{\"requestId\":\"$context.requestId\"}"
  }
}

# CloudFormation: Enable access logging on API Gateway V2 stage
Resources:
  <example_resource_name>:
    Type: AWS::ApiGatewayV2::Stage
    Properties:
      ApiId: <example_resource_id>
      StageName: <example_resource_name>
      AccessLogSettings: # Critical: enables access logging for the stage
        DestinationArn: <example_log_group_arn> # CloudWatch Logs log group ARN
        Format: '{"requestId":"$context.requestId"}' # Minimal required format

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = apigatewayv2_api_access_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

API Gateway stage has a WAF Web ACL attached API Gateway V2 API has an authorizer configured

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires