View a markdown version of this page

Set up CloudWatch logging for REST APIs in API Gateway - Amazon API Gateway
Permissions for CloudWatch logging
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Set up CloudWatch logging for REST APIs in API Gateway

To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. For more information about CloudWatch, see Monitor REST API execution with Amazon CloudWatch metrics.

There are two types of API logging in CloudWatch:

  • Execution logging – API Gateway logs the actions taken to process API requests, including errors and execution traces. You can also configure Amazon CloudWatch Logs delivery to route execution logs to your own destinations.

  • Access logging – You log who accessed your API and how. You create your own log group, choose a log format, and specify which $context variables to include.

You can enable execution logging and access logging independently of each other.

Permissions for CloudWatch logging

To enable CloudWatch Logs, you must grant API Gateway permission to read and write logs to CloudWatch for your account. The AmazonAPIGatewayPushToCloudWatchLogs managed policy has all the required permissions.

Note

API Gateway calls Amazon Security Token Service in order to assume the IAM role, so make sure that Amazon STS is enabled for the Region. For more information, see Managing Amazon STS in an Amazon Region.

To grant these permissions to your account, create an IAM role with apigateway.amazonaws.com as its trusted entity, attach the preceding policy to the IAM role, and set the IAM role ARN on the cloudWatchRoleArn property on your Account. You must set the cloudWatchRoleArn property separately for each Amazon Region in which you want to enable CloudWatch Logs.

If you receive an error when setting the IAM role ARN, check your Amazon Security Token Service account settings to make sure that Amazon STS is enabled in the Region that you're using. For more information about enabling Amazon STS, see Managing Amazon STS in an Amazon Region in the IAM User Guide.

Topics