Skip to content

Conversation

keetonian
Copy link
Contributor

@keetonian keetonian commented Feb 13, 2020

Issue #, if available:
N/A

Description of changes:
Document support for AccessLogSettings for Http Api and add tests.

Description of how you validated changes:
make pr

Checklist:

  • Write/update tests
  • make pr passes
  • Update documentation
  • Verify transformed template deploys and application functions as expected
  • Add/update example to examples/2016-10-31

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@keetonian keetonian requested a review from jlhood February 13, 2020 00:50
@codecov-io
Copy link

codecov-io commented Feb 13, 2020

Codecov Report

Merging #1448 into develop will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff            @@
##           develop    #1448   +/-   ##
========================================
  Coverage    94.37%   94.37%           
========================================
  Files           78       78           
  Lines         4678     4678           
  Branches       934      934           
========================================
  Hits          4415     4415           
  Misses         121      121           
  Partials       142      142

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 54ab0bc...41f981f. Read the comment docs.

Copy link
Contributor

@jlhood jlhood left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you actually try this one out on a real CFN stack? As I recall, they replaced the account-level role with a service-linked role that gets created by API GW, but requires that the API GW resource be prefixed with something like apigateway-. Just want to know if that's actually true in practice. If so, it really needs to be called out in the docs, because it's pretty surprising behavior to be forced to explicitly name your API in your CFN template.

@keetonian
Copy link
Contributor Author

I deployed the following template, invoked it, and verified that the access was logged in the access logs.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
  MyLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: python3.7
      InlineCode: |
        def handler(event, context):
            return {'body': 'Hello World!', 'statusCode': 200}
      MemorySize: 128
      Events:
        GetApi:
          Type: HttpApi
          Properties:
            ApiId: !Ref MyApi

  MyApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      AccessLogSettings:
        DestinationArn: !GetAtt Logs.Arn
        Format: $context.requestId
  Logs:
    Type: AWS::Logs::LogGroup

This created a LogGroup with a name of <stack-name>-Logs-<HASH>, which does not appear to make any naming restrictions on either the logs or the api.

I think in the AWS SAM Documentation we should make a recommendation to name the Log Group following the normal naming convention: /aws/apigateway/<log-group-name>, where <log-group-name> would be something like $(AWS::StackName}-${MyApi}-access-logs.

@praneetap praneetap self-assigned this Feb 19, 2020
@ShreyaGangishetty ShreyaGangishetty merged commit f5353cb into aws:develop Feb 20, 2020
@keetonian keetonian deleted the http-access-logs branch March 11, 2020 18:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants