Cloudwatch Logs Must Be Enabled For All APIs

More Info:

AWS CloudWatch logs should be enabled for all your APIs created with Amazon API Gateway service in order to track and analyze execution behavior at the API stage level.

Risk Level

Low

Address

Operational Maturity, Security

Compliance Standards

HIPAA, SOC2, HITRUST, NISTCSF, PCIDSS

Triage and Remediation

Check Cause

Using Console

Using CLI

First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the API Gateway and CloudWatch Logs.
Once the AWS CLI is set up, you can list all the APIs in the API Gateway using the following command:
```
aws apigateway get-rest-apis
```
This command will return a list of all the APIs in the API Gateway.
For each API, you can check if CloudWatch Logs are enabled using the following command:
```
aws apigateway get-stage --rest-api-id <restApiId> --stage-name <stageName>
```
Replace <restApiId> and <stageName> with the ID and name of the API and stage you want to check. This command will return the details of the stage, including whether CloudWatch Logs are enabled.
To automate the process, you can write a Python script using the boto3 library to iterate over all the APIs and stages and check if CloudWatch Logs are enabled. The script would use the get_rest_apis and get_stage methods of the boto3.client('apigateway') object to perform the same actions as the above CLI commands.

Using Python

Install and configure AWS SDK for Python (Boto3): You need to install and configure AWS SDK for Python (Boto3) on your local system. This SDK allows Python developers to write software that makes use of services like Amazon S3, Amazon EC2, etc. You can install it using pip:
```
pip install boto3
```
Then, configure your AWS credentials to enable Boto3 to communicate with AWS services. You can do this by creating the files ~/.aws/credentials and ~/.aws/config:
```
[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY
```
```
[default]
region=us-east-1
```
Use Boto3 to interact with AWS API Gateway: You can use Boto3 to interact with AWS API Gateway and retrieve information about your APIs. Here is a sample script that lists all your APIs:
```
import boto3

client = boto3.client('apigateway')

response = client.get_rest_apis()

for item in response['items']:
    print(item['name'])
```

Check CloudWatch Logs for each API: For each API, you need to check if CloudWatch Logs are enabled. You can do this by retrieving the stage settings for each API and checking the ‘loggingLevel’ attribute. Here is a sample script that checks if CloudWatch Logs are enabled for all APIs:

import boto3

client = boto3.client('apigateway')

response = client.get_rest_apis()

for item in response['items']:
    stages = client.get_stages(restApiId=item['id'])
    for stage in stages['item']:
        if 'methodSettings' in stage:
            for settings in stage['methodSettings'].values():
                if 'loggingLevel' not in settings or settings['loggingLevel'] != 'INFO':
                    print(f"CloudWatch Logs are not enabled for API {item['name']} at stage {stage['stageName']}")

Analyze the results: The script will print the names of the APIs and stages for which CloudWatch Logs are not enabled. You can use this information to identify the misconfigurations in your AWS API Gateway setup.

Additional Reading:

https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Cloudwatch Logs Must Be Enabled For All APIs

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Additional Reading:

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Check Cause

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Additional Reading: