Set up CloudWatch logging for REST APIs in API Gateway
To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. For more information about CloudWatch, see Monitor REST API execution with Amazon CloudWatch metrics.
There are two types of API logging in CloudWatch:
-
Execution logging – API Gateway logs the actions taken to process API requests, including errors and execution traces. You can also configure Amazon CloudWatch Logs delivery to route execution logs to your own destinations.
-
Access logging – You log who accessed your API and how. You create your own log group, choose a log format, and specify which
$contextvariables to include.
You can enable execution logging and access logging independently of each other.
Permissions for CloudWatch logging
To enable CloudWatch Logs, you must grant API Gateway permission to read and write logs to CloudWatch for your account. The AmazonAPIGatewayPushToCloudWatchLogs managed policy has all the required permissions.
Note
API Gateway calls AWS Security Token Service in order to assume the IAM role, so make sure that AWS STS is enabled for the Region. For more information, see Managing AWS STS in an AWS Region.
To grant these permissions to your account, create an IAM role with
apigateway.amazonaws.com as its trusted entity, attach the preceding
policy to the IAM role, and set the IAM role ARN on the cloudWatchRoleArn
property on your Account. You must
set the cloudWatchRoleArn property separately for each AWS Region in which you
want to enable CloudWatch Logs.
If you receive an error when setting the IAM role ARN, check your AWS Security Token Service account settings to make sure that AWS STS is enabled in the Region that you're using. For more information about enabling AWS STS, see Managing AWS STS in an AWS Region in the IAM User Guide.
