AppSync API Should Have Logging Enabled.

More Info:

Checks if an AWS AppSync API has logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or fieldLogLevel is neither ERROR nor ALL.

Risk Level

Medium

Address

Monitoring

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
DPDPA
Digital Operational Resilience Act (EU)
GDPR
HIPAA
ISO 27001
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
StateRAMP
UK NCSC Cyber Assessment Framework

Triage and Remediation

Cause
Remediation

Check Cause

Using Console

Sign in to the AWS Management Console.
Navigate to the AWS AppSync service by typing ‘AppSync’ in the search bar and selecting it from the dropdown menu.
In the AppSync dashboard, you will see a list of all your APIs. Select the API you want to check.
In the settings of the selected API, look for the ‘Logging’ section. If logging is enabled, you will see the details of the logging configuration, such as the log level and the CloudWatch Logs role ARN. If this section is not present or it says that logging is disabled, then the AppSync API does not have logging enabled.

Using CLI

First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access the AppSync APIs.
Once the AWS CLI is set up, you can list all the AppSync APIs using the following command:
aws appsync list-graphql-apis --region your-region
Replace ‘your-region’ with the region where your APIs are located. This command will return a list of all the AppSync APIs in the specified region.
To check the logging configuration of each API, you need to describe the API using the following command:
aws appsync get-graphql-api --api-id your-api-id --region your-region
Replace ‘your-api-id’ with the ID of the API you want to check and ‘your-region’ with the region where your API is located. This command will return the details of the specified API.
In the output of the above command, look for the ‘logConfig’ field. If the ‘logConfig’ field is present and the ‘cloudWatchLogsRoleArn’ and ‘fieldLogLevel’ are set, then logging is enabled for the API. If the ‘logConfig’ field is not present or the ‘cloudWatchLogsRoleArn’ and ‘fieldLogLevel’ are not set, then logging is not enabled for the API.

Using Python

Install and configure AWS SDK for Python (Boto3): Before you can begin writing Python scripts to detect misconfigurations, you need to install and configure Boto3. You can install it using pip:
pip install boto3
Then, configure your AWS credentials to enable Boto3 to communicate with AWS services:
aws configure
You’ll be prompted to provide your AWS Access Key ID and Secret Access Key, which you can find in your AWS Management Console.
Import necessary libraries and establish a client connection: In your Python script, you’ll need to import Boto3 and establish a client connection to AWS AppSync. Here’s how you can do it:
import boto3 client = boto3.client('appsync')

List all AppSync APIs and check their logging status: You can use the list_graphql_apis method to get a list of all AppSync APIs, and then check the logConfig field of each API to see if logging is enabled. Here’s a sample script:

import boto3

client = boto3.client('appsync')

response = client.list_graphql_apis()

for api in response['graphqlApis']:
    if 'logConfig' in api:
        if api['logConfig']['cloudWatchLogsRoleArn'] and api['logConfig']['fieldLogLevel']:
            print(f"Logging is enabled for API: {api['name']}")
        else:
            print(f"Logging is not fully enabled for API: {api['name']}")
    else:
        print(f"Logging is not enabled for API: {api['name']}")

Handle pagination: The list_graphql_apis method returns a maximum of 25 APIs at a time. If you have more than 25 APIs, you’ll need to handle pagination by using the nextToken field in the response:

import boto3

client = boto3.client('appsync')

paginator = client.get_paginator('list_graphql_apis')

for page in paginator.paginate():
    for api in page['graphqlApis']:
        if 'logConfig' in api:
            if api['logConfig']['cloudWatchLogsRoleArn'] and api['logConfig']['fieldLogLevel']:
                print(f"Logging is enabled for API: {api['name']}")
            else:
                print(f"Logging is not fully enabled for API: {api['name']}")
        else:
            print(f"Logging is not enabled for API: {api['name']}")

This script will print out the names of all APIs and whether logging is enabled for each one.

Remediation

Using Console

To remediate the misconfiguration of AppSync API not having logging enabled in AWS using the AWS Management Console, follow these step-by-step instructions:

Sign in to the AWS Management Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and sign in using your AWS account credentials.
Navigate to AWS AppSync: In the AWS Management Console, type “AppSync” in the search bar at the top and select “AWS AppSync” from the dropdown list.
Select the AppSync API: In the AWS AppSync console, select the API that you want to enable logging for from the list of APIs displayed.
Enable Logging: In the API details page, click on the “Settings” tab on the left-hand side menu.
Configure Logging: Scroll down to the “Log Config” section and click on the “Edit” button.
Enable Access Logging: In the “Access Logging” section, toggle the switch to enable access logging for the AppSync API.
Set Log Level (Optional): Optionally, you can set the log level based on your requirements (e.g., INFO, ERROR, DEBUG).
Choose Log Group: Select an existing CloudWatch log group or create a new one where the logs will be stored.
Save Changes: Click on the “Save” button to save the changes and enable logging for the AppSync API.
Verify Logging: To verify that logging is enabled, you can perform some API operations and check the CloudWatch log group for the logs generated by the AppSync API.

By following these steps, you can remediate the misconfiguration of AppSync API not having logging enabled in AWS using the AWS Management Console.

Using CLI

To remediate the misconfiguration of AppSync API not having logging enabled in AWS using AWS CLI, you can follow these steps:

Enable Logging for the AppSync API: Run the following AWS CLI command to enable logging for your AppSync API:
aws appsync update-graphql-api --api-id YOUR_API_ID --logging-config=LogConfig="{cloudWatchLogsRoleArn=YOUR_CLOUDWATCH_LOGS_ROLE_ARN,fieldLogLevel=ALL}"
- Replace YOUR_API_ID with the actual ID of your AppSync API.
- Replace YOUR_CLOUDWATCH_LOGS_ROLE_ARN with the ARN of the IAM role that has permission to write logs to CloudWatch.
Verify the Logging Configuration: You can verify that logging is enabled for your AppSync API by describing the API and checking the logging configuration:
aws appsync get-graphql-api --api-id YOUR_API_ID --query 'graphqlApi.loggingConfig'
Ensure that the response includes the CloudWatch Logs Role ARN and the desired log level.
Test the Logging: Make some requests to your AppSync API and check if the logs are being generated in CloudWatch Logs.

By following these steps, you can successfully remediate the misconfiguration of AppSync API not having logging enabled in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of enabling logging for an AWS AppSync API using Python, you can follow these steps:

Import the necessary Python libraries:

import boto3

Initialize the AWS AppSync client:

appsync_client = boto3.client('appsync')

Get the list of APIs in the AWS AppSync service:

response = appsync_client.list_graph_ql_apis()
apis = response['graphQLApis']

Identify the target API for which logging needs to be enabled. You can either specify the API directly or loop through all APIs to find the target one.
Enable logging for the identified API:

api_id = 'your_api_id_here'
response = appsync_client.update_graph_ql_api(
    apiId=api_id,
    logConfig={
        'cloudWatchLogsRoleArn': 'arn:aws:iam::YOUR_ACCOUNT_ID:role/YOUR_CLOUDWATCH_LOGS_ROLE',
        'fieldLogLevel': 'ALL',
        'excludeVerboseContent': False
    }
)

Replace 'your_api_id_here' with the actual API ID of the target API and 'arn:aws:iam::YOUR_ACCOUNT_ID:role/YOUR_CLOUDWATCH_LOGS_ROLE' with the ARN of the IAM role that grants permission to write logs to CloudWatch.

Verify that logging has been enabled successfully by checking the API settings or CloudWatch logs for the API.

By following these steps and executing the Python script, you can remediate the misconfiguration of enabling logging for an AWS AppSync API.

Using Terraform

resource "aws_appsync_graphql_api" "this" {
  name                = "APP_SYNC_API_NAME" # replace with your AppSync API name
  authentication_type = "API_KEY"           # or your existing auth type

  log_config {
    field_log_level         = "ALL" # or "ERROR" to remain compliant
    cloudwatch_logs_role_arn = aws_iam_role.appsync_cw_logs.arn
  }

  # keep your other existing arguments here (schema, xray, user_pool_config, etc.)
}

resource "aws_iam_role" "appsync_cw_logs" {
  name = "AppSyncCWLogsRole-ASSET_LABEL" # replace ASSET_LABEL to avoid clashes

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { Service = "appsync.amazonaws.com" }
        Action    = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "appsync_cw_logs" {
  role       = aws_iam_role.appsync_cw_logs.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"
}

This configuration creates a new IAM role for AppSync logging and attaches the AWSAppSyncPushToCloudWatchLogs managed policy, then enables logging on the AppSync API with field_log_level = "ALL" and the new role’s ARN, matching the CLI remediation.
Ensure the IAM role name (AppSyncCWLogsRole-ASSET_LABEL) is unique in your account; if a role with the same name already exists, Terraform will attempt to manage it and may fail or conflict.
Updating log_config on aws_appsync_graphql_api is an in-place change and should not force replacement of the API; existing logging configuration (if any) will be fully replaced by this block.

Verification with terraform plan:

aws_iam_role.appsync_cw_logs and aws_iam_role_policy_attachment.appsync_cw_logs should be planned for creation.
aws_appsync_graphql_api.this should show an in-place update adding or modifying the log_config block with field_log_level = "ALL" (or "ERROR") and the cloudwatch_logs_role_arn set to the new role.

Additional Reading:

https://docs.aws.amazon.com/config/latest/developerguide/appsync-logging-enabled.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

AppSync API Should Have Logging Enabled.

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Check Cause

​Remediation

​

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Remediation

Additional Reading: