Logging Amazon AppSync API calls using Amazon CloudTrail
Amazon AppSync is integrated with Amazon CloudTrail, a service that provides a record of actions taken by a user, role, or Amazon service in Amazon AppSync. CloudTrail captures all API calls for Amazon AppSync as events. The calls captured include calls from the Amazon AppSync console and from code calls to the Amazon AppSync APIs. You can use the information collected by CloudTrail to determine the request that was made to Amazon AppSync, the IP address of the requester, who made the request, when the request was made, and additional details.
You can create a trail to enable continuous delivery of CloudTrail events to an Amazon Simple Storage Service (Amazon S3) bucket, including events for Amazon AppSync. If you don't configure a trail, you can still view the most recent events in the CloudTrail console.
Important
Not all GraphQL actions are currently logged. AppSync does not log Query and Mutation actions to CloudTrail.
For more information about CloudTrail, see the Amazon CloudTrail User Guide.
Amazon AppSync information in CloudTrail
CloudTrail is enabled on your Amazon account when you create the account. In the CloudTrail console in Event history, you can view, search, and download recent events in your Amazon account. For more information, see Viewing Events with CloudTrail Event History in the Amazon CloudTrail User Guide.
For an ongoing record of events in your Amazon account, including events for Amazon AppSync, create a trail. By default, when you create a trail in the console, the trail applies to all Amazon Regions. The trail logs events from all Regions in the Amazon partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you can configure other Amazon services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see the following in the Amazon CloudTrail User Guide:
CloudTrail logs all Amazon AppSync API operations. For example, calls to the
CreateGraphqlApi, CreateDataSource, and ListResolvers
APIs generate entries in the CloudTrail log files. These and other operations are documented in the
Amazon AppSync API Reference.
Every event or log entry contains information about who generated the request. The identity information helps you determine:
-
Whether the request was made with root or Amazon Identity and Access Management (IAM) user credentials.
-
Whether the request was made with temporary security credentials for a role or federated user.
-
Whether the request was made by another Amazon service.
For more information, see CloudTrail userIdentity Element in the Amazon CloudTrail User Guide.
Understanding Amazon AppSync log file entries
CloudTrail delivers events as log files that contain one or more log entries. An event represents a single request from any source and includes information about the requested operation, the date and time of the operation, the request parameters, and so on. Because these log files aren't an ordered stack trace of the public API calls, they don't appear in any specific order.
The following example CloudTrail log entry demonstrates the CreateApiKey
operation.
{ "Records": [{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "A1B2C3D4E5F6G7EXAMPLE", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "Alice" }, "eventTime": "2018-01-31T21:49:09Z", "eventSource": "appsync.amazonaws.com", "eventName": "CreateApiKey", "awsRegion": "us-west-2", "sourceIPAddress": "192.2.0.1", "userAgent": "aws-cli/1.11.72 Python/2.7.11 Darwin/16.7.0 botocore/1.5.35", "requestParameters": { "apiId": "a1b2c3d4e5f6g7h8i9jexample" }, "responseElements": { "apiKey": { "id": "***", "expires": 1518037200000 } }, "requestID": "99999999-9999-9999-9999-999999999999", "eventID": "99999999-9999-9999-9999-999999999999", "readOnly": false, "eventType": "AwsApiCall", "recipientAccountId": "111122223333" } ] }
The following example CloudTrail log entry demonstrates the ListApiKeys
operation.
{ "Records": [{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "A1B2C3D4E5F6G7EXAMPLE", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "Alice" }, "eventTime": "2018-01-31T21:49:09Z", "eventSource": "appsync.amazonaws.com", "eventName": "ListApiKeys", "awsRegion": "us-west-2", "sourceIPAddress": "192.2.0.1", "userAgent": "aws-cli/1.11.72 Python/2.7.11 Darwin/16.7.0 botocore/1.5.35", "requestParameters": { "apiId": "a1b2c3d4e5f6g7h8i9jexample" }, "responseElements": { "apiKeys": [ { "id": "***", "expires": 1517954400000 }, { "id": "***", "expires": 1518037200000 }, ] }, "requestID": "99999999-9999-9999-9999-999999999999", "eventID": "99999999-9999-9999-9999-999999999999", "readOnly": false, "eventType": "AwsApiCall", "recipientAccountId": "111122223333" } ] }
The following example CloudTrail log entry demonstrates the DeleteApiKey
operation.
{ "Records": [{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "A1B2C3D4E5F6G7EXAMPLE", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "Alice" }, "eventTime": "2018-01-31T21:49:09Z", "eventSource": "appsync.amazonaws.com", "eventName": "DeleteApiKey", "awsRegion": "us-west-2", "sourceIPAddress": "192.2.0.1", "userAgent": "aws-cli/1.11.72 Python/2.7.11 Darwin/16.7.0 botocore/1.5.35", "requestParameters": { "id": "***", "apiId": "a1b2c3d4e5f6g7h8i9jexample" }, "responseElements": null, "requestID": "99999999-9999-9999-9999-999999999999", "eventID": "99999999-9999-9999-9999-999999999999", "readOnly": false, "eventType": "AwsApiCall", "recipientAccountId": "111122223333" } ] }