01 Create an IAM role that allows Amazon API Gateway to push logs to CloudWatch Logs. Define the trust relationship policy for this IAM role as shown in the example below. Paste the following policy document to a JSON file named iam-role-trust-policy.json:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "apigateway.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
02 Run create-role command (OSX/Linux/UNIX) to create the IAM role that allows Amazon API Gateway to push logs to CloudWatch Logs using the trust relationship policy defined at the previous step (i.e. iam-role-trust-policy.json):
aws iam create-role
--role-name api-access-log-role
--assume-role-policy-document file://iam-role-trust-policy.json
03 The command output should return the metadata available for the new IAM role:
{
"Role": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "apigateway.amazonaws.com"
}
}
]
},
"RoleId": "AAAABBBBCCCCDDDDEEEE",
"CreateDate": "2023-01-12T10:00:00Z",
"RoleName": "api-access-log-role",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:role/api-access-log-role"
}
}
04 Run attach-role-policy command (OSX/Linux/UNIX) to attach the AmazonAPIGatewayPushToCloudWatchLogs managed policy to the newly created IAM role. Use the --policy-arn command parameter to specify the ARN of the AWS-managed policy that you want to attach to your IAM role (the command does not produce an output):
aws iam attach-role-policy
--role-name api-access-log-role
--policy-arn arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs
05 Run update-stage command (OSX/Linux/UNIX) using the name of the API stage that you want to reconfigure as the identifier parameter, to enable access logging for the selected API Gateway V2 API stage. The following command request example enables access logging for an API stage named "Production", created for an API identified by the ID "abcabcabca". The access logs are published to a CloudWatch Logs log group named "access-log-group" and use the following format: "$context.extendedRequestId $context.identity.sourceIp $context.identity.caller $context.identity.user $context.status":
aws apigatewayv2 update-stage
--region us-east-1
--api-id abcabcabca
--stage-name Production
--access-log-settings '{"DestinationArn":"arn:aws:logs:us-east-1:123456789012:log-group:access-log-group","Format":"$context.extendedRequestId $context.identity.sourceIp $context.identity.caller $context.identity.user $context.status"}'
06 The command output should return the API stage information:
{
"AccessLogSettings": {
"DestinationArn": "arn:aws:logs:us-east-1:123456789012:log-group:access-log-group",
"Format": "$context.extendedRequestId $context.identity.sourceIp $context.identity.caller $context.identity.user $context.status"
},
"CreatedDate": "2023-08-03T12:21:00+00:00",
"DefaultRouteSettings": {
"DataTraceEnabled": false,
"DetailedMetricsEnabled": false,
"LoggingLevel": "OFF",
"ThrottlingBurstLimit": 5000,
"ThrottlingRateLimit": 10000.0
},
"DeploymentId": "abcdabcd",
"LastUpdatedDate": "2023-08-03T15:17:17+00:00",
"RouteSettings": {},
"StageName": "production",
"StageVariables": {},
"Tags": {}
}
07 Repeat steps no. 5 and 6 to enable access logging for each API stage created for the selected API Gateway V2 API.
08 Repeat steps no. 5 – 7 to reconfigure each Amazon API Gateway V2 API available in the selected AWS region.
09 Change the AWS cloud region by updating the --region command parameter value and perform the Remediation process for other regions.
Security 
Reliability 
Operational