API Gateway REST and WebSocket API execution logging should be enabled

How to fix it

In the console

API Gateway → APIs → the API → Stages → the stage → Logs and tracing

CloudWatch log role ARN

Settings → Logging, once per Region: a role apigateway.amazonaws.com assumes, with AmazonAPIGatewayPushToCloudWatchLogs

CloudWatch Logs

Errors only, or Errors and info logs

Data tracing

Off on production stages; it logs full requests and responses, sensitive data included

With the AWS CLI

aws apigateway update-stage --rest-api-id <rest-api-id> --stage-name <stage-name> --patch-operations 'op=replace,path=/*/*/logging/loglevel,value=ERROR'

With Terraform

• Overwrites existing settings: Unless the settings block also sets throttling_burst_limit and throttling_rate_limit, both become -1, removing any stage-wide throttling already on the stage.

resource "aws_api_gateway_method_settings" "all" {
  rest_api_id = var.rest_api_id
  stage_name  = var.stage_name
  method_path = "*/*"

  settings {
    logging_level = "ERROR"
  }
}