Logging AWS AppSync API calls using AWS CloudTrail
AWS AppSync is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or AWS service in AWS AppSync. CloudTrail captures all API calls for AWS AppSync as events. The calls captured include calls from the AWS AppSync console and from code calls to the AWS AppSync APIs. You can use the information collected by CloudTrail to determine the request that was made to AWS AppSync, the IP address of the requester, who made the request, when the request was made, and additional details.
You can create a trail to enable continuous delivery of CloudTrail events to an Amazon Simple Storage Service (Amazon S3) bucket, including events for AWS AppSync. If you don't configure a trail, you can still view the most recent events in the CloudTrail console.
Important
Not all GraphQL actions are currently logged. AppSync does not log Query and Mutation actions to CloudTrail.
For more information about CloudTrail, see the AWS CloudTrail User Guide.
AWS AppSync information in CloudTrail
CloudTrail is enabled on your AWS account when you create the account. In the CloudTrail console in Event history, you can view, search, and download recent events in your AWS account. For more information, see Viewing Events with CloudTrail Event History in the AWS CloudTrail User Guide.
For an ongoing record of events in your AWS account, including events for AWS AppSync, create a trail. By default, when you create a trail in the console, the trail applies to all AWS Regions. The trail logs events from all Regions in the AWS partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you can configure other AWS services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see the following in the AWS CloudTrail User Guide:
CloudTrail logs all AWS AppSync API operations. For example, calls to the
CreateGraphqlApi, CreateDataSource, and ListResolvers
APIs generate entries in the CloudTrail log files. These and other operations are documented in the
AWS AppSync API Reference.
Every event or log entry contains information about who generated the request. The identity information helps you determine:
-
Whether the request was made with root or AWS Identity and Access Management (IAM) user credentials.
-
Whether the request was made with temporary security credentials for a role or federated user.
-
Whether the request was made by another AWS service.
For more information, see CloudTrail userIdentity Element in the AWS CloudTrail User Guide.
Understanding AWS AppSync log file entries
CloudTrail delivers events as log files that contain one or more log entries. An event represents a single request from any source and includes information about the requested operation, the date and time of the operation, the request parameters, and so on. Because these log files aren't an ordered stack trace of the public API calls, they don't appear in any specific order.
The following example CloudTrail log entry demonstrates the CreateApiKey
operation.
{ "Records": [{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "A1B2C3D4E5F6G7EXAMPLE", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "Alice" }, "eventTime": "2018-01-31T21:49:09Z", "eventSource": "appsync.amazonaws.com", "eventName": "CreateApiKey", "awsRegion": "us-west-2", "sourceIPAddress": "192.2.0.1", "userAgent": "aws-cli/1.11.72 Python/2.7.11 Darwin/16.7.0 botocore/1.5.35", "requestParameters": { "apiId": "a1b2c3d4e5f6g7h8i9jexample" }, "responseElements": { "apiKey": { "id": "***", "expires": 1518037200000 } }, "requestID": "99999999-9999-9999-9999-999999999999", "eventID": "99999999-9999-9999-9999-999999999999", "readOnly": false, "eventType": "AwsApiCall", "recipientAccountId": "111122223333" } ] }
The following example CloudTrail log entry demonstrates the ListApiKeys
operation.
{ "Records": [{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "A1B2C3D4E5F6G7EXAMPLE", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "Alice" }, "eventTime": "2018-01-31T21:49:09Z", "eventSource": "appsync.amazonaws.com", "eventName": "ListApiKeys", "awsRegion": "us-west-2", "sourceIPAddress": "192.2.0.1", "userAgent": "aws-cli/1.11.72 Python/2.7.11 Darwin/16.7.0 botocore/1.5.35", "requestParameters": { "apiId": "a1b2c3d4e5f6g7h8i9jexample" }, "responseElements": { "apiKeys": [ { "id": "***", "expires": 1517954400000 }, { "id": "***", "expires": 1518037200000 }, ] }, "requestID": "99999999-9999-9999-9999-999999999999", "eventID": "99999999-9999-9999-9999-999999999999", "readOnly": false, "eventType": "AwsApiCall", "recipientAccountId": "111122223333" } ] }
The following example CloudTrail log entry demonstrates the DeleteApiKey
operation.
{ "Records": [{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "A1B2C3D4E5F6G7EXAMPLE", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "Alice" }, "eventTime": "2018-01-31T21:49:09Z", "eventSource": "appsync.amazonaws.com", "eventName": "DeleteApiKey", "awsRegion": "us-west-2", "sourceIPAddress": "192.2.0.1", "userAgent": "aws-cli/1.11.72 Python/2.7.11 Darwin/16.7.0 botocore/1.5.35", "requestParameters": { "id": "***", "apiId": "a1b2c3d4e5f6g7h8i9jexample" }, "responseElements": null, "requestID": "99999999-9999-9999-9999-999999999999", "eventID": "99999999-9999-9999-9999-999999999999", "readOnly": false, "eventType": "AwsApiCall", "recipientAccountId": "111122223333" } ] }
