API Gateway Now Supports CloudWatch Logs Delivery: Trying Out Delivery to S3 and CloudWatch Logs

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  API Gateway REST API execution logs - CloudWatch Logs delivery (Vended Logs) verification stack.
  Deploy with EnableLogDelivery=false first (standard execution logging only),
  then redeploy with EnableLogDelivery=true to add the deliveries.

Parameters:
  StackPrefix:
    Type: String
    Default: apigw-exec-logs-demo
    Description: Prefix used for resource names.

  StageName:
    Type: String
    Default: prod

  EnableLogDelivery:
    Type: String
    Default: "false"
    AllowedValues: ["true", "false"]
    Description: >-
      false = standard execution logging only (API Gateway managed log group).
      true  = create delivery source / destinations / deliveries.

  LogRetentionInDays:
    Type: Number
    Default: 30

Conditions:
  WithDelivery: !Equals [!Ref EnableLogDelivery, "true"]

Resources:

  # ---------------------------------------------------------------
  # NOTE: the account-level CloudWatch role for API Gateway
  # (AWS::ApiGateway::Account / cloudWatchRoleArn) is intentionally NOT in this
  # template. It is a single account/Region-wide setting shared by every REST
  # API, so managing it here could overwrite or delete another API's setting.
  # Configure it outside CloudFormation beforehand; see verification-procedure.md
  # step 1 ("account level CloudWatch role").
  # ---------------------------------------------------------------

  # ---------------------------------------------------------------
  # Lambda (echo backend)
  # ---------------------------------------------------------------
  FunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${StackPrefix}-lambda-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  FunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${StackPrefix}-fn"
      RetentionInDays: !Ref LogRetentionInDays

  Function:
    Type: AWS::Lambda::Function
    DependsOn: FunctionLogGroup
    Properties:
      FunctionName: !Sub "${StackPrefix}-fn"
      Runtime: python3.13
      Handler: index.lambda_handler
      Role: !GetAtt FunctionRole.Arn
      Timeout: 10
      Code:
        ZipFile: |
          import json

          def lambda_handler(event, context):
              body = event.get("body") or ""
              response = {
                  "path": event.get("path"),
                  "httpMethod": event.get("httpMethod"),
                  "queryStringParameters": event.get("queryStringParameters"),
                  "receivedBodyBytes": len(body.encode("utf-8")),
                  "echo": body[:200],
              }
              return {
                  "statusCode": 200,
                  "headers": {"content-type": "application/json"},
                  "body": json.dumps(response),
              }

  FunctionPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt Function.Arn
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${RestApi}/*/*/*"

  # ---------------------------------------------------------------
  # REST API (minimal: /echo -> Lambda proxy)
  # ---------------------------------------------------------------
  RestApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Ref StackPrefix
      Description: Execution log delivery verification API
      EndpointConfiguration:
        Types: [REGIONAL]

  EchoResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RestApi
      ParentId: !GetAtt RestApi.RootResourceId
      PathPart: echo

  EchoMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApi
      ResourceId: !Ref EchoResource
      HttpMethod: ANY
      # Verification-only endpoint: no authorizer. Do not copy this to production.
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${Function.Arn}/invocations"

  Deployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn: EchoMethod
    Properties:
      RestApiId: !Ref RestApi

  ApiStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      RestApiId: !Ref RestApi
      DeploymentId: !Ref Deployment
      StageName: !Ref StageName
      MethodSettings:
        - ResourcePath: "/*"
          HttpMethod: "*"
          LoggingLevel: INFO
          DataTraceEnabled: true

  # ---------------------------------------------------------------
  # Delivery destinations (conditional)
  # ---------------------------------------------------------------
  DeliveryLogGroupJson:
    Type: AWS::Logs::LogGroup
    Condition: WithDelivery
    Properties:
      LogGroupName: !Sub "/aws/vendedlogs/apigateway/${StackPrefix}/${StageName}"
      RetentionInDays: !Ref LogRetentionInDays

  DeliveryLogGroupPlain:
    Type: AWS::Logs::LogGroup
    Condition: WithDelivery
    Properties:
      LogGroupName: !Sub "/aws/vendedlogs/apigateway/${StackPrefix}/${StageName}-plain"
      RetentionInDays: !Ref LogRetentionInDays

  DeliveryBucket:
    Type: AWS::S3::Bucket
    Condition: WithDelivery
    Properties:
      BucketName: !Sub "${StackPrefix}-${AWS::AccountId}-${AWS::Region}"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          # SSE-S3 (Amazon S3 managed keys). No KMS key is used: SSE-S3 needs no
          # extra configuration and adds no key charges.
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256

  # Bucket policy per "Logs sent to Amazon S3" (V2 permissions):
  # https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-S3.html
  DeliveryBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: WithDelivery
    Properties:
      Bucket: !Ref DeliveryBucket
      PolicyDocument:
        Version: "2012-10-17"
        Id: AWSLogDeliveryWrite20150319
        Statement:
          - Sid: AWSLogDeliveryWrite
            Effect: Allow
            Principal:
              Service: delivery.logs.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub "${DeliveryBucket.Arn}/AWSLogs/${AWS::AccountId}/*"
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:delivery-source:*"

  # ---------------------------------------------------------------
  # Vended Logs delivery (conditional)
  # ---------------------------------------------------------------
  DeliverySource:
    Type: AWS::Logs::DeliverySource
    Condition: WithDelivery
    # PutDeliverySource fails unless execution logging is already enabled on the
    # stage, so the stage must exist with LoggingLevel INFO/ERROR first.
    DependsOn: ApiStage
    Properties:
      Name: !Sub "${StackPrefix}-source"
      LogType: EXECUTION_LOGS
      ResourceArn: !Sub "arn:${AWS::Partition}:apigateway:${AWS::Region}:${AWS::AccountId}:/restapis/${RestApi}/stages/${StageName}"

  # (1) own CloudWatch Logs log group, structured JSON (all record fields)
  DestinationCwlJson:
    Type: AWS::Logs::DeliveryDestination
    Condition: WithDelivery
    Properties:
      Name: !Sub "${StackPrefix}-cwl-json"
      DestinationResourceArn: !GetAtt DeliveryLogGroupJson.Arn
      OutputFormat: json

  DeliveryCwlJson:
    Type: AWS::Logs::Delivery
    Condition: WithDelivery
    Properties:
      DeliverySourceName: !Ref DeliverySource
      DeliveryDestinationArn: !GetAtt DestinationCwlJson.Arn

  # (2) S3 bucket, JSON
  DestinationS3Json:
    Type: AWS::Logs::DeliveryDestination
    Condition: WithDelivery
    DependsOn: DeliveryBucketPolicy
    Properties:
      Name: !Sub "${StackPrefix}-s3-json"
      DestinationResourceArn: !GetAtt DeliveryBucket.Arn
      OutputFormat: json

  DeliveryS3Json:
    Type: AWS::Logs::Delivery
    Condition: WithDelivery
    Properties:
      DeliverySourceName: !Ref DeliverySource
      DeliveryDestinationArn: !GetAtt DestinationS3Json.Arn

  # (3) own log group, payload only (equivalent to standard execution log text).
  #     The CLI guidance uses --field-delimiter "" (empty string), but the
  #     CloudFormation property has a minimum length of 1, so it is omitted here.
  #     Verify whether RecordFields: [payload] alone reproduces the plain output.
  DestinationCwlPlain:
    Type: AWS::Logs::DeliveryDestination
    Condition: WithDelivery
    Properties:
      Name: !Sub "${StackPrefix}-cwl-plain"
      DestinationResourceArn: !GetAtt DeliveryLogGroupPlain.Arn
      OutputFormat: plain

  DeliveryCwlPlain:
    Type: AWS::Logs::Delivery
    Condition: WithDelivery
    Properties:
      DeliverySourceName: !Ref DeliverySource
      DeliveryDestinationArn: !GetAtt DestinationCwlPlain.Arn
      RecordFields:
        - payload

Outputs:
  ApiInvokeUrl:
    Value: !Sub "https://${RestApi}.execute-api.${AWS::Region}.amazonaws.com/${StageName}"
  RestApiId:
    Value: !Ref RestApi
  StageArn:
    Value: !Sub "arn:${AWS::Partition}:apigateway:${AWS::Region}:${AWS::AccountId}:/restapis/${RestApi}/stages/${StageName}"
  AutoManagedLogGroupName:
    Description: API Gateway managed log group (not managed by this stack; delete manually at teardown)
    Value: !Sub "API-Gateway-Execution-Logs_${RestApi}/${StageName}"
  DeliveryLogGroupJsonName:
    Condition: WithDelivery
    Value: !Ref DeliveryLogGroupJson
  DeliveryLogGroupPlainName:
    Condition: WithDelivery
    Value: !Ref DeliveryLogGroupPlain
  DeliveryBucketName:
    Condition: WithDelivery
    Value: !Ref DeliveryBucket

{
    "delivery": {
        "id": "<delivery-id>",
        "deliverySourceName": "apigw-exec-logs-demo-source",
        "deliveryDestinationType": "CWL",
        "recordFields": [
            "resource_arn",
            "event_timestamp",
            "api_id",
            "stage",
            "resource_path",
            "http_method",
            "payload"
        ]
    }
}