ARN role for API Gateway to enable logs error

user_4863734 0
Viewed 7873

I can't enable write access to CloudWatch logs in AWS API Gateway by providing a new IAM Role.

I checked several tutorials, checked everything. Even attached AdministratorAccess policy to my IAM Role and checked that The identity provider(s) apigateway.amazonaws.com is a Trusted entity.

But if still fails when I try to enable logs in API Gateway:

The role ARN does not have required permissions set to API Gateway

aws-api-gateway amazon-cloudwatch amazon-iam amazon-web-services
5 Answers

I was having this issue today as I was trying to set up a user that I had given those permissions to. Resolved it by going through the "create role" wizard and selecting the API Gateway service which created an IAM arn with the correct permissions.

Select your use case
API Gateway
Allows API Gateway to push logs to CloudWatch Logs.
user_12880770

For me the following AWS configuration fixed this issue.

Edited the "Trust Relationship" in the Role with the following configuration:

{
 "Version": "2012-10-17",
 "Statement": [
 {
    "Effect": "Allow",
    "Principal": {
    "Service": ["apigateway.amazonaws.com","lambda.amazonaws.com"]
    },
    "Action": "sts:AssumeRole"
  }
 ]
}

Edited the policies with the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "logs:*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Here is a more detailed description for the policy configuration: policy description

user_89006830

After much frustration, I followed Alex' advice then gave up for a while.

Eventually, the IAM "stuff" propagated and the "enable logs" requests completely successfully.

user_849190

In case you want to use least privileges for your role, this is the minimum set of permissions to add:

CloudWatchRolePolicy: 
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: MyAPIGatewayRolePolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
            - "logs:CreateLogGroup"
            - "logs:CreateLogStream"
            - "logs:DescribeLogGroups"
            - "logs:DescribeLogStreams"
            Resource:
            - "arn:aws:logs:<account>:log-group:API-Gateway-Execution-Logs_<apiId>/<apiStageName>:*"
            - "arn:aws:logs:<accountId>:log-group:/aws/apigateway/*:*"
          - Effect: Allow
            Action:
            - "logs:PutLogEvents"
            Resource:
            - "arn:aws:logs:<account>:log-group:API-Gateway-Execution-Logs_<apiId>/<apiStageName>:*:*"
            - "arn:aws:logs:<accountId>:log-group:/aws/apigateway/*:*:*"

Replacing the parts in <...> appropriately.

This is because AWS automatically adds log groups with specific names for you e.g. /aws/apigateway/welcome and API-Gateway-Execution-Logs_<apiId>/<stageId>. Sadly I can't find any documentation about these so the above is a result of trial and error to get something to save successfully and logs show up!

user_36659490
  1. Go to IAM and create or select an existing role
  2. Attach the AWS managed policy AmazonAPIGatewayPushToCloudWatchLogs to it, copy the role's ARN
  3. Go to API Gateway > Settings and paste the ARN and hit Save
  4. Select your API > Stages > pick a stage > Logs/Tracing tab
  5. Select 'Enable CloudWatch Logs' and/or 'Log full requests/responses data' as appropriate and hit Save Changes.
user_83945100
Related