While AWS WAF's integration with API Gateway is well-documented, establishing a robust logging pipeline to S3 that is both cost-effective and usable for security analysis often presents a configuration challenge. Many implementations suffer from fragmented logs or excessive storage costs due to verbose formatting.
I will outline a step-by-step procedure that ensures comprehensive logging, leveraging AWS's native services without introducing external log shippers. The key is in the precise IAM configuration and the WAF logging destination.
**Prerequisites & Initial Setup**
* An active AWS WAF Web ACL.
* A REST or HTTP API Gateway stage associated with the Web ACL.
* An S3 bucket for logs (enable server-side encryption as per your policy).
**Core Integration Steps**
1. **Create the WAF Logging Configuration Resource**
This is often the missing piece. You must create a `AWS::WAFv2::LoggingConfiguration` resource, which links your Web ACL, the log destination, and the fields to log. Below is a CloudFormation snippet for the critical resource.
```yaml
WAFLoggingConfiguration:
Type: AWS::WAFv2::LoggingConfiguration
Properties:
ResourceArn: !GetAtt YourWebACL.Arn
LogDestinationConfigs:
- !Sub "arn:aws:s3:::your-waf-logs-bucket/${AWS::StackName}/api-gateway"
RedactedFields:
- SingleHeader:
Name: Authorization
LoggingFilter:
DefaultBehavior: "KEEP"
Filters:
- Behavior: "DROP"
Requirement: "MEETS_ALL"
Conditions:
- ActionCondition:
Action: "COUNT"
```
*Note:* The filter shown drops `COUNT` actions from the logs to reduce noise and cost, capturing only `ALLOW` and `BLOCK`.
2. **S3 Bucket Policy for WAF Log Delivery**
The S3 bucket must grant explicit permissions to the AWS WAF service principal. An overly permissive policy is a common pitfall.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSWAFLogsWrite",
"Effect": "Allow",
"Principal": {
"Service": "delivery.logs.amazonaws.com"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::your-waf-logs-bucket/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control",
"aws:SourceAccount": "your-account-id"
},
"ArnLike": {
"aws:SourceArn": "arn:aws:wafv2:us-east-1:your-account-id:*/webacl/*"
}
}
}
]
}
```
Pay close attention to the `Condition` block; it enforces both account ID and Web ACL ARN validation for security.
**Analysis & Cost Optimization**
Logs are delivered in GZIP-compressed JSON lines format. To analyze them, you can query directly with Athena after configuring the appropriate table schema. For cost control, implement an S3 Lifecycle Policy to transition logs to Infrequent Access or Glacier after a defined period, and delete them thereafter.
The primary benefit of this structured approach is the creation of an immutable, queryable audit trail of all API Gateway requests evaluated by WAF, which is indispensable for security incident response and tuning your rule sets.
--crusader
Commit early, deploy often, but always rollback-ready.