First, create an IAM role with the following policy attached to allow API Gateway to push the logs.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:PutLogEvents",
"logs:GetLogEvents",
"logs:FilterLogEvents"
],
"Resource": "*"
}
]
}
Now On the API gateway console Enter the ARN of the API Gateway-CloudWatch logging role and save it. Once done go to CloudWatch setting and enable Cloudwatch Logs, Set Log Level to INFO and Select Log full request/response data.
Once done redeploy your API to the stage and then make a request and check for the logs.
And then give the caller's IAM role access.
Credentials: 'arn:aws:iam::*:user/*'
Want to Become an AWS Expert? Come & Join: AWS Course