[apigatewayv2] Allow configuring access logging

Currently there’s no way on the HttpApi or HttpStage construct to enable access logging as specified via https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigatewayv2-stage-accesslogsettings.html.

This is pretty easy to setup via sam but there’s no equivalent atm for cdk.

Use Case

Enable access logs for HttpApi

Proposed Solution

• Implement AccessLogSettings on HttpStage
• Add logging prop to HttpApi which enables logging for all routes

I also think when the above is added to HttpApi that it should create its own log group and the permissions necessary for the HttpApi to write to it.

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

[lifeofzero]

@jumpinjan this is how I got it to work, if that’s helpful.

    // Setup the access log for APIGWv2
    const accessLogs = new logs.LogGroup(this, 'APIGW-AccessLogs')
    const stage = httpApi.defaultStage?.node.defaultChild as apigateway.CfnStage
    stage.accessLogSettings = {
      destinationArn: accessLogs.logGroupArn,
      format: JSON.stringify({
        requestId: '$context.requestId',
        userAgent: '$context.identity.userAgent',
        sourceIp: '$context.identity.sourceIp',
        requestTime: '$context.requestTime',
        requestTimeEpoch: '$context.requestTimeEpoch',
        httpMethod: '$context.httpMethod',
        path: '$context.path',
        status: '$context.status',
        protocol: '$context.protocol',
        responseLength: '$context.responseLength',
        domainName: '$context.domainName'
      })
    }

    const role = new iam.Role(this, 'ApiGWLogWriterRole', {
      assumedBy: new iam.ServicePrincipal('apigateway.amazonaws.com')
    })

    const policy = new iam.PolicyStatement({
      actions: [
        'logs:CreateLogGroup',
        'logs:CreateLogStream',
        'logs:DescribeLogGroups',
        'logs:DescribeLogStreams',
        'logs:PutLogEvents',
        'logs:GetLogEvents',
        'logs:FilterLogEvents'
      ],
      resources: ['*']
    })

    role.addToPolicy(policy)
    accessLogs.grantWrite(role) 

[PeterAronZentai]

@ltearno it does indeed work!

    const log = new awslog.LogGroup(this, 'log')
    const stage = backendB.defaultStage?.node.defaultChild as  apigwv2.CfnStage;
    stage.accessLogSettings = {
        destinationArn: log.logGroupArn,
        format: `$context.identity.sourceIp - - [$context.requestTime] "$context.httpMethod $context.routeKey $context.protocol" $context.status $context.responseLength $context.requestId`,
    }

Much thanks!

Also you unlocked L1 hacking for me - megathanks for that.