Back to Checks
aws

AWS AppSync API has field-level logging set to ALL or ERROR

appsync_field_level_logging_enabled
Service: appsyncSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsAppSyncGraphQLApi

AWS AppSync GraphQL APIs have field-level logging configured at the resolver level. The check looks for log levels of ERROR or ALL to confirm field resolution events are recorded.

Prowler logoProwlerprowler-provider-aws

Risk

Without field-level logs, resolver access and mutations lack auditability, reducing detection of data exfiltration and tampering (confidentiality and integrity). Limited traces hinder incident response and root-cause analysis, increasing recovery time.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks appsync_field_level_logging_enabled

Recommendation

  • Enable field-level logging at least ERROR; raise to INFO/DEBUG/ALL only for troubleshooting.
  • Enforce least privilege on the logging role.
  • Avoid sensitive data in logs; limit verbose content.
  • Set retention and consider log sampling to balance visibility and cost.

Remediation

CLI

aws appsync update-graphql-api --api-id <example_resource_id> --name <api-name> --authentication-type AWS_IAM --log-config fieldLogLevel=ERROR,cloudWatchLogsRoleArn=<cloudwatch_logs_role_arn>

Terraform

# Terraform - Enable field-level logging for AppSync API
resource "aws_appsync_graphql_api" "<example_resource_name>" {
  name                = "<example_resource_name>"
  authentication_type = "AWS_IAM"

  log_config {
    cloudwatch_logs_role_arn = "<cloudwatch_logs_role_arn>" # CRITICAL: permits logging to CloudWatch
    field_log_level          = "ERROR"                        # CRITICAL: compliant field-level logging
  }
}

NativeIaC

# CloudFormation - Enable field-level logging for AppSync API
Resources:
  <example_resource_name>:
    Type: AWS::AppSync::GraphQLApi
    Properties:
      Name: <example_resource_name>
      AuthenticationType: AWS_IAM
      LogConfig:
        CloudWatchLogsRoleArn: arn:aws:iam::<account-id>:role/<example_resource_name>  # CRITICAL: allows AppSync to write logs
        FieldLogLevel: ERROR  # CRITICAL: sets field-level logging to a compliant level

Other

1In the AWS Console, go to AppSync and open your GraphQL API
2Go to Settings > Logging
3Turn on Enable logs
4Set Field resolver log level to ERROR (or ALL)
5Select an IAM role that allows AppSync to write to CloudWatch Logs
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.appsync.appsync_client import appsync_client


class appsync_field_level_logging_enabled(Check):
    def execute(self):
        findings = []
        # Check only GraphQL APIs because boto3 does not have a method to get other types of AppSync APIs (list_apis is not working)
        for api in appsync_client.graphql_apis.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=api)
            report.status = "PASS"
            report.status_extended = (
                f"AppSync API {api.name} has field log level enabled."
            )
            if api.field_log_level != "ALL" and api.field_log_level != "ERROR":
                report.status = "FAIL"
                report.status_extended = (
                    f"AppSync API {api.name} does not have field log level enabled."
                )
            findings.append(report)

        return findings

References