rage.fail

aws-apigateway-execution-access-log-event

Execution logging with data tracing or permissive access-log formats can capture request/response headers, bodies, authorizer context, and query tokens.

awscritical service: aws:apigateway emits ContainsSecret

Where it sits

location	`CloudWatch Logs API Gateway execution/access log event.message`
location kind	`log_field`
data kinds	`credential` `api_key` `bearer_token` `session_token` `password` `pii` `sensitive_data`
emits edge	`ContainsSecret`
service	API Gateway (aws:apigateway)

Collection recipe

access mode	`indirect_destination`
operation	`logs:FilterLogEvents`
response path	`Events[].Message`
encoding	`string`
params	`{"LogGroupName": "\u003capi-gateway-log-group\u003e"}`

Required permissions

logs:FilterLogEvents
apigateway:GET

References

https://docs.aws.amazon.com/cli/latest/reference/logs/filter-log-events.html
https://docs.aws.amazon.com/service-authorization/latest/reference/service-reference.html
https://servicereference.us-east-1.amazonaws.com/v1/logs/logs.json
https://servicereference.us-east-1.amazonaws.com/v1/apigateway/apigateway.json