Rule: API Gateway Stage Logging Should Be Enabled
This rule requires enabling logging for API Gateway stages to ensure proper monitoring and troubleshooting.
| Rule | API Gateway stage logging should be enabled |
| Framework | SOC 2 |
| Severity | ✔ High |
Rule Description
API Gateway stage logging should be enabled for SOC 2 compliance. This rule ensures that all activities related to the API Gateway stages are properly logged and auditable. Enabling logging helps in monitoring and identifying any suspicious or unauthorized activities performed on the API Gateway stages, which is crucial for maintaining the security and compliance standards required for SOC 2 certification.
Troubleshooting Steps (if any)
If stage logging is not enabled for API Gateway, follow these steps to troubleshoot:
- 1.Check the API Gateway configuration settings to confirm if stage logging is enabled.
- 2.Verify the IAM permissions of the user or role associated with the API Gateway. Ensure that the required permissions are granted to enable stage logging.
- 3.Check the CloudTrail logs to identify any errors or issues related to stage logging.
- 4.Review the API Gateway documentation and AWS forums for any reported issues related to stage logging.
Necessary Codes (if any)
To enable stage logging for API Gateway, you can use the AWS Command Line Interface (CLI). Here is an example of the necessary CLI code:
aws apigateway update-stage \ --rest-api-id <your-rest-api-id> \ --stage-name <your-stage-name> \ --patch-operations op=replace,path=/accessLogSettings/destinationArn,value=<your-arn>
In the code above, replace
<your-rest-api-id><your-stage-name><your-arn>Step by Step Guide for Remediation
To enable stage logging for API Gateway and ensure SOC 2 compliance, follow these steps:
- 1.Log in to the AWS Management Console.
- 2.Go to the API Gateway service.
- 3.Select the API Gateway that you want to enable stage logging for.
- 4.In the left sidebar, click on the "Stages" tab.
- 5.Choose the specific stage for which you want to enable logging.
- 6.Click on the "Logs/Tracing" tab.
- 7.Under the "Access logs" section, click on the "Edit" button.
- 8.In the "Destination ARN" field, enter the ARN of the destination where the log events will be published. This can be an Amazon CloudWatch Logs group ARN.
- 9.Click on the "Save" button to save the changes.
- 10.Repeat steps 5-9 for any other stages that need stage logging enabled.
- 11.Verify that the stage logging is successfully enabled by checking the CloudTrail logs or the destination logs (e.g., CloudWatch Logs).
By following the above steps, you will enable stage logging for API Gateway, ensuring that all activities in the stages are properly logged for SOC 2 compliance.