CloudWatch Logs Missing For API Gateway

Risk Level: Medium

Description: 

This plugin ensures that Cloud Watch Logs are enabled for Amazon API Gateways to track and analyze execution behavior at the API stage level and also debug issues related to request execution or client access to API.

About the Service :

API(Application Programming Interface) Gateway is an AWS service that lies between the client and tons of backend services. The actions performed by API Gateways include creating, deploying, and managing RESTful API and WebSocket API.

Impact : 

We won’t be able to analyze the execution behavior or debug issues at the API Stage level. There will be a huge issue in the troubleshooting of the problems that may arise with the API.

Steps to reproduce :

1. Log in to AWS Management Console.
2. Navigate to the API Gateway Dashboard.
3. On the top left, select the APIs option.
   
4. We can select from a list of APIs to examine.
5. On the selected API, click on its name to access the details.
6. In the selected submenu, select the Stages option.
   
7. Select the API Stage for examination. Then Logs tab in the API Stage Editor.
8. In the CloudWatch Settings section, verify if the Enable CloudWatch Logs box is checked or not.
9. If the logs box is unchecked then there will be no logs i.e. CloudWatch Logs missing.

Steps for remediation :

1. Log in to AWS Management Console.
2. Navigate to the API Gateway Dashboard.
3. On the top left, select the APIs option.
   
4. We can select from a list of APIs to examine.
5. On the selected API, click on its name to access the details.
6. In the selected submenu, select the Stages option.
   
7. Select the API Stage for examination. Then Logs tab in the API Stage Editor.
8. In the CloudWatch Settings section, verify if the Enable CloudWatch Logs box is checked or not.
9. If the logs box is unchecked then check the Enable CloudWatch Logs box.