logo

Database

Terraform Missing Access Log Settings

Description

Identifies AWS API Gateway stages that have access logging disabled. Missing access logs can hinder security monitoring, incident investigation and compliance by failing to track API requests and responses.

Weakness:

408 - Traceability Loss - API Gateway

Category: Deceptive Interactions

Detection Strategy

    • Examines Terraform configuration files for AWS API Gateway stage resources

    • Verifies if access logging settings are configured for the API Gateway stage

    • Reports a vulnerability when access_log_settings is missing or disabled for an API Gateway stage

Vulnerable code example

resource "aws_api_gateway_stage" "example" {
  deployment_id = aws_api_gateway_deployment.example.id
  rest_api_id   = aws_api_gateway_rest_api.example.id
  stage_name    = "example"
  # Vulnerable: Missing xray_tracing_enabled for proper request tracing/monitoring
}

✅ Secure code example

resource "aws_api_gateway_stage" "example" {
  deployment_id = aws_api_gateway_deployment.example.id
  rest_api_id   = aws_api_gateway_rest_api.example.id
  stage_name    = "example"

  # Safe: Enable X-Ray tracing for request monitoring and debugging
  xray_tracing_enabled = true
...