AWS AppSync API has field-level logging set to ALL or ERROR

Check ID: appsync_field_level_logging_enabled
Provider: AWS
Service: appsync
Severity: MEDIUM
Categories: logging
Resource type: AwsAppSyncGraphQLApi

What this check verifies

AWS AppSync GraphQL APIs have field-level logging configured at the resolver level. The check looks for log levels of ERROR or ALL to confirm field resolution events are recorded.

Risk

Without field-level logs, resolver access and mutations lack auditability, reducing detection of data exfiltration and tampering (confidentiality and integrity). Limited traces hinder incident response and root-cause analysis, increasing recovery time.

Recommendation

Enable field-level logging at least ERROR; raise to INFO/DEBUG/ALL only for troubleshooting.
Enforce least privilege on the logging role.
Avoid sensitive data in logs; limit verbose content.
Set retention and consider log sampling to balance visibility and cost.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws appsync update-graphql-api --api-id <example_resource_id> --name <api-name> --authentication-type AWS_IAM --log-config fieldLogLevel=ERROR,cloudWatchLogsRoleArn=<cloudwatch_logs_role_arn>

# Terraform - Enable field-level logging for AppSync API
resource "aws_appsync_graphql_api" "<example_resource_name>" {
  name                = "<example_resource_name>"
  authentication_type = "AWS_IAM"

  log_config {
    cloudwatch_logs_role_arn = "<cloudwatch_logs_role_arn>" # CRITICAL: permits logging to CloudWatch
    field_log_level          = "ERROR"                        # CRITICAL: compliant field-level logging
  }
}

# CloudFormation - Enable field-level logging for AppSync API
Resources:
  <example_resource_name>:
    Type: AWS::AppSync::GraphQLApi
    Properties:
      Name: <example_resource_name>
      AuthenticationType: AWS_IAM
      LogConfig:
        CloudWatchLogsRoleArn: arn:aws:iam::<account-id>:role/<example_resource_name>  # CRITICAL: allows AppSync to write logs
        FieldLogLevel: ERROR  # CRITICAL: sets field-level logging to a compliant level

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = appsync_field_level_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AppStream fleet idle timeout is 10 minutes or less AWS AppSync GraphQL API does not use API key authentication

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires