Back to Checks
aws

API Gateway V2 API stage has access logging enabled

apigatewayv2_api_access_logging_enabled
Service: apigatewayv2Severity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsApiGatewayV2Stage

API Gateway v2 stages have access logging configured to capture request details and deliver them to a logging destination (e.g., CloudWatch Logs or Firehose). The evaluation looks for logging being enabled at each API stage.

Prowler logoProwlerprowler-provider-aws

Risk

Without access logs, API calls lack traceability, making it hard to spot credential misuse, route abuse, or anomalous traffic.

This reduces confidentiality and integrity through undetected data access or manipulation, and impacts availability by slowing incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks apigatewayv2_api_access_logging_enabled

Recommendation

Enable stage-level access logging to a centralized destination and use structured formats. Apply appropriate retention and restrict log access per least privilege. Integrate logs with monitoring and alerts to detect anomalies, and complement with defense in depth controls.

Remediation

CLI

aws apigatewayv2 update-stage --api-id <API_ID> --stage-name <STAGE_NAME> --access-log-settings DestinationArn=<LOG_GROUP_ARN>,Format='{"requestId":"$context.requestId"}'

Terraform

# Terraform: Enable access logging on API Gateway V2 stage
resource "aws_apigatewayv2_stage" "<example_resource_name>" {
  api_id = "<example_resource_id>"
  name   = "<example_resource_name>"

  access_log_settings { # Critical: enables access logging for the stage
    destination_arn = "<example_log_group_arn>"
    format          = "{\"requestId\":\"$context.requestId\"}"
  }
}

NativeIaC

# CloudFormation: Enable access logging on API Gateway V2 stage
Resources:
  <example_resource_name>:
    Type: AWS::ApiGatewayV2::Stage
    Properties:
      ApiId: <example_resource_id>
      StageName: <example_resource_name>
      AccessLogSettings: # Critical: enables access logging for the stage
        DestinationArn: <example_log_group_arn> # CloudWatch Logs log group ARN
        Format: '{"requestId":"$context.requestId"}' # Minimal required format

Other

1In the AWS Console, go to API Gateway > your HTTP/WebSocket API
2Open Stages and select the target stage
3In Access logging, enable Access logging
4Set Log destination ARN to your CloudWatch log group (or Firehose stream)
5Set Log format to: {"requestId":"$context.requestId"}
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.apigatewayv2.apigatewayv2_client import (
    apigatewayv2_client,
)


class apigatewayv2_api_access_logging_enabled(Check):
    def execute(self):
        findings = []
        for api in apigatewayv2_client.apis:
            report = Check_Report_AWS(metadata=self.metadata(), resource=api)
            for stage in api.stages:
                if stage.logging:
                    report.status = "PASS"
                    report.status_extended = f"API Gateway V2 {api.name} ID {api.id} in stage {stage.name} has access logging enabled."
                    report.resource_id = f"{api.name}-{stage.name}"
                else:
                    report.status = "FAIL"
                    report.status_extended = f"API Gateway V2 {api.name} ID {api.id} in stage {stage.name} has access logging disabled."
                    report.resource_id = f"{api.name}-{stage.name}"

                findings.append(report)

        return findings

References