Back to Checks
aws

API Gateway REST API stage has logging enabled

apigateway_restapi_logging_enabled
Service: apigatewaySeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:AwsApiGatewayStage

API Gateway REST API stages with stage logging enabled to emit execution or access logs to CloudWatch

Prowler logoProwlerprowler-provider-aws

Risk

Without stage logging, API activity lacks visibility, hindering detection of abuse and incident response. Attackers can probe endpoints, exfiltrate data, or tamper integrations without traces, impacting confidentiality, integrity, and availability and blocking forensic investigation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks apigateway_restapi_logging_enabled

Recommendation

Enable CloudWatch Logs for all API Gateway stages, using ERROR or INFO as appropriate. Include request IDs (e.g., $context.requestId). Enforce least privilege on logs, set retention and alerts for anomalies. Avoid sensitive data in logs and use defense in depth with tracing.

Remediation

CLI

aws apigateway update-stage --rest-api-id <REST_API_ID> --stage-name <STAGE_NAME> --patch-operations op=replace,path='/*/*/logging/loglevel',value=ERROR

Terraform

# Enable execution logging for all methods in a REST API stage
resource "aws_api_gateway_method_settings" "<example_resource_name>" {
  rest_api_id = "<example_resource_id>"
  stage_name  = "<example_resource_name>"
  method_path = "*/*"
  settings {
    logging_level = "ERROR"  # CRITICAL: enables stage execution logging
  }
}

NativeIaC

# CloudFormation: enable execution logging on a REST API stage
Resources:
  <example_resource_name>:
    Type: AWS::ApiGateway::Stage
    Properties:
      StageName: <example_resource_name>
      RestApiId: <example_resource_id>
      DeploymentId: <example_resource_id>
      MethodSettings:
        - ResourcePath: "/*"
          HttpMethod: "*"
          LoggingLevel: ERROR  # CRITICAL: turns on execution logging for all methods

Other

1In the API Gateway console, open Settings and set CloudWatch log role ARN if prompted
2Go to APIs > select your REST API > Stages > select the stage
3Click Logs and tracing > CloudWatch Logs > choose Errors only (or Errors and info)
4Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.apigateway.apigateway_client import (
    apigateway_client,
)


class apigateway_restapi_logging_enabled(Check):
    def execute(self):
        findings = []
        for rest_api in apigateway_client.rest_apis:
            for stage in rest_api.stages:
                report = Check_Report_AWS(metadata=self.metadata(), resource=stage)
                report.resource_id = rest_api.name
                report.region = rest_api.region
                if stage.logging:
                    report.status = "PASS"
                    report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has logging enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"API Gateway {rest_api.name} ID {rest_api.id} in stage {stage.name} has logging disabled."
                findings.append(report)

        return findings

References