Findings
API Gateway REST and WebSocket API execution logging should be enabled
Updated: June 19, 2025
Description
The API Gateway stage is not configured to enable execution logging for REST or WebSocket API operations.
Without logging, it becomes challenging to monitor API activity, troubleshoot issues, or identify potential security threats. Logging is crucial for maintaining visibility into API usage, analyzing performance metrics, and detecting anomalies.
Example Attack
An attacker attempts to exploit an API endpoint by sending a large number of requests to a REST API with invalid parameters. Without execution logging enabled, you wouldn't see the abnormal traffic patterns or error responses. With logging enabled, all failed requests would be captured, allowing your security team to detect and mitigate the attack by blocking the malicious IP or investigating the issue further.
Remediation
Enable logging for all REST and WebSocket API stages. Configure the logging level to either INFO for detailed insights or ERROR to capture issues effectively.
Security Frameworks
When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.
- Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types that the system is capable of logging];
- Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
- Specify the following event types for logging within the system: [Assignment: organization-defined event types (subset of the event types defined in AU-2a.) along with the frequency of (or situation requiring) logging for each identified event type];
- Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and
- Review and update the event types selected for logging [Assignment: organization-defined frequency].
Ensure that audit records contain information that establishes the following:
- What type of event occurred;
- When the event occurred;
- Where the event occurred;
- Source of the event;
- Outcome of the event; and
- Identity of any individuals, subjects, or objects/entities associated with the event.
Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions to be covered by non-repudiation].
- Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components];
- Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and
- Generate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3.
Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:
- Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics];
- Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness;
- Ongoing control assessments in accordance with the continuous monitoring strategy;
- Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
- Correlation and analysis of information generated by control assessments and monitoring;
- Response actions to address results of the analysis of control assessment and monitoring information; and
- Reporting the security and privacy status of the system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].
(a) Detect and deny outgoing communications traffic posing a threat to external systems; and
(b) Audit the identity of internal users associated with denied communications.
Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user; alert [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined other actions]].