Configuring logging for an HTTP API

You can enable logging to write logs to CloudWatch Logs. You can use logging variables to customize the content of your logs.

To enable logging for an HTTP API, you must do the following.

1. Ensure that your IAM user has the required permissions to enable logging.

2. Create a CloudWatch Logs log group.

3. Provide the ARN of the CloudWatch Logs log group for a stage of your API.

Permissions to enable logging

To enable logging for an API, your IAM user must have the following permissions.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:GetLogEvents",
                "logs:FilterLogEvents"
            ],
            "Resource": "arn:aws:logs:us-east-2:123456789012:log-group:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogDelivery",
                "logs:PutResourcePolicy",
                "logs:UpdateLogDelivery",
                "logs:DeleteLogDelivery",
                "logs:CreateLogGroup",
                "logs:DescribeResourcePolicies",
                "logs:GetLogDelivery",
                "logs:ListLogDeliveries"
            ],
            "Resource": "*"
        }
    ]
}

            

Creating a log group

To create a log group by using the AWS Management Console

1. Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.

2. Choose Log groups.

3. Choose Create log group.

4. Enter a log group name, and then choose Create.

5. Note the Amazon Resource Name (ARN) for your log group. The ARN format is arn:aws:logs:region: account-id:log-group:log-group-name. You need the log group ARN to enable access logging for your HTTP API.

Enabling logging for a stage

To enable logging by using the AWS Management Console

1. Open the API Gateway console.

2. Choose an API.

3. Under Monitor, choose Logging.

4. Choose the stage for which you want to enable logging.

5. Choose Edit.

6. Use the Access logging toggle to enable access logging.

7. For Log destination, enter the ARN of a CloudWatch Logs log group. The ARN format is arn:aws:logs:region:account-id:log-group:log-group-name.

8. Enter a log format in Log format. You can choose CLF, JSON, XML, or CSV to use one of the provided examples as a guide.

9. Choose Save.