Ensure AppSync has Field-Level logs enabled

appsync_field_level_logs_enabled

Severity

low

Vendor

AWS

Resource

AppSync

Description

AWS AppSync provides a robust, scalable GraphQL interface for application developers to combine data from multiple sources, including Amazon DynamoDB, AWS Lambda, and HTTP APIs.

Setting an appropriate FieldLogLevel can be useful for troubleshooting security and operational issues. Thus, it’s recommended to use ERROR or ALL field log levels.

Examples

CloudFormation

{
  "Resources": {
    "None": {
      "Type": "AWS::AppSync::GraphQLApi",
      "Properties": {
        "Name": "dummy",
        "AuthenticationType": "API_KEY",
        "LogConfig": {
          "CloudWatchLogsRoleArn": "iam_role_arn",
          "FieldLogLevel": "NONE" (1)
        }
      }
    }
  }
}

1	`FieldLogLevel` set to `None` means no field-level logs are captured.

Resources:
  None:
    Type: "AWS::AppSync::GraphQLApi"
    Properties:
      Name: "dummy"
      AuthenticationType: "API_KEY"
      LogConfig:
        CloudWatchLogsRoleArn: "iam_role_arn"
        FieldLogLevel: "NONE" (1)

1	`FieldLogLevel` set to `None` means no field-level logs are captured.

Terraform

resource "aws_appsync_graphql_api" {
  authentication_type = "API_KEY"

  log_config {
    cloudwatch_logs_role_arn = "aws_iam_role.arn"
    field_log_level = "NONE" (1)
  }
}

1	The `field_log_level` is set to 'NONE'.

Mitigation / Fix

Buildtime

CloudFormation

{
  "Resources": {
    "None": {
      "Type": "AWS::AppSync::GraphQLApi",
      "Properties": {
        "Name": "dummy",
        "AuthenticationType": "API_KEY",
        "LogConfig": {
          "CloudWatchLogsRoleArn": "iam_role_arn",
          "FieldLogLevel": "ERROR" (1)
        }
      }
    }
  }
}

1	`FieldLogLevel` set to `Error` or `Info` means field-level logs are captured.

Resources:
  None:
    Type: "AWS::AppSync::GraphQLApi"
    Properties:
      Name: "dummy"
      AuthenticationType: "API_KEY"
      LogConfig:
        CloudWatchLogsRoleArn: "iam_role_arn"
        FieldLogLevel: "ERROR" (1)

1	`FieldLogLevel` set to `Error` or `All` means field-level logs are captured.

Terraform

resource "aws_appsync_graphql_api" {
  authentication_type = "API_KEY"

  log_config {
    cloudwatch_logs_role_arn = "aws_iam_role.example.arn"
    field_log_level          = "ALL"(1)
  }
}

1	Ensure you have set a `field_log_level`. `ALL` or `ERROR` are the recommended values.