[apigatewayv2] Allow configuring access logging

[iRoachie]

Currently there's no way on the HttpApi or HttpStage construct to enable access logging as specified via https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigatewayv2-stage-accesslogsettings.html.

This is pretty easy to setup via sam but there's no equivalent atm for cdk.

Use Case

Enable access logs for HttpApi

Proposed Solution

• Implement AccessLogSettings on HttpStage
• Add logging prop to HttpApi which enables logging for all routes

I also think when the above is added to HttpApi that it should create its own log group and the permissions necessary for the HttpApi to write to it.

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

[franciscoandrade82]

Hello! Do you have news on this feature? Any plans to include it in a future version?

[PeterAronZentai]

Hello would someone help formulating logging setting for HTTP API - with maybe the help of Cf* objects and the build hook I've read about?
Or is there a way to run some aws sdk commands as part of CDK provisioning code?

[iRoachie]

@franciscoandrade-unit I started work on it in #11126 but I haven't finished it as yet

[ltearno]

@PeterAronZentai this page should help to formulate the cdk code to add the accesslog parameter on the underlying CfnStage resource of a Stage construct : https://docs.aws.amazon.com/cdk/latest/guide/cfn_layer.html#cfn_layer_resource

Then the CfnStage has its options available (cdk: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-apigatewayv2.CfnStage.html, cloudformation : https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html).

Something like this should work :

// "apigateway.defaultStage.node.defaultChild" accesses the L1 Resource in the L2 Stage
const defaultStage = apiGateway.defaultStage.node.defaultChild as apigw.CfnStage

// the L1 settings are always available because they are CloudFormation constructs and
// AWS seems to always guarantee the 1 to 1 mapping
defaultStage.accessLogSettings = {
    destinationArn: `...`,
    format: JSON.stringify({
        "requestId": "$context.requestId",
        "ip": "$context.identity.sourceIp",
        "caller": "$context.identity.caller",
        "user": "$context.identity.user",
        "requestTime": "$context.requestTime",
        "httpMethod": "$context.httpMethod",
        "resourcePath": "$context.resourcePath",
        "status": "$context.status",
        "protocol": "$context.protocol",
        "responseLength": "$context.responseLength"
    })
}

If you try it, let me know because I will need it soon ! :)

[PeterAronZentai]

@ltearno it does indeed work!

    const log = new awslog.LogGroup(this, 'log')
    const stage = backendB.defaultStage?.node.defaultChild as  apigwv2.CfnStage;
    stage.accessLogSettings = {
        destinationArn: log.logGroupArn,
        format: `$context.identity.sourceIp - - [$context.requestTime] "$context.httpMethod $context.routeKey $context.protocol" $context.status $context.responseLength $context.requestId`,
    }

Much thanks!

Also you unlocked L1 hacking for me - megathanks for that.

[ltearno]

You're welcome, thank you !