AWS AppSync should have field-level logging enabled

How to fix it

In the console

AppSync → APIs → the API → Settings → Logging

Enable Logs

On

Field resolver log level

Error, or All, which also logs the data every field resolves to

Create or use an existing role

New role, or a role AppSync can assume that allows logs:CreateLogGroup, logs:CreateLogStream and logs:PutLogEvents

With the AWS CLI

• Overwrites existing settings: The CLI call replaces the API's settings rather than merging them, so read the API with get-graphql-api first and resupply its authorization modes, X-Ray and other settings.

aws appsync update-graphql-api --api-id <api-id> --name <api-name> --authentication-type <authentication-type> --log-config fieldLogLevel=ERROR,cloudWatchLogsRoleArn=<logs-role-arn> --region <region>

With Terraform

resource "aws_appsync_graphql_api" "this" {
  name                = var.api_name
  authentication_type = var.authentication_type

  log_config {
    cloudwatch_logs_role_arn = var.logs_role_arn
    field_log_level          = "ERROR"
  }
}