API Gateway stage does not have access logging enabled

Severity: Low
Service: API Gateway
Check ID: APIGW_ACCESS_LOGS_DISABLED

What this check finds

Access logging for API Gateway stages records caller identity, latency, status codes, and request/response details. Without it, detecting unauthorized access, API abuse, or data exfiltration through the API requires reconstructing traffic from CloudTrail management events, which do not include request payloads.

Passing looks like: API Gateway access logging enabled.

How to fix it

Create a CloudWatch Logs log group, then enable access logging on the stage.

AWS CLI

aws apigateway update-stage --rest-api-id API_ID --stage-name STAGE_NAME --patch-operations op=replace,path=/accessLogSettings/destinationArn,value=LOG_GROUP_ARN

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

API Gateway → select API → Stages → select stage → Logs and tracing → Access logging → ARN of log group.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to API Gateway stage does not have access logging enabled
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	AU-2 Event Logging AU-12 Audit Record Generation
NIST Cybersecurity Framework 2.0	PR.PS-04 Log records are generated for monitoring
ISO/IEC 27001:2022 Annex A	A.8.15 Logging

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More API Gateway checks

All API Gateway checks