terraform - API 网关日志未显示为 terraform

Question

我正在尝试将 CloudWatch 日志记录添加到我的 API 网关并已遵循 posts like this one创建以下地形:

resource "aws_iam_role" "iam_for_api_gateway" {
  name = "${var.name}-api-gateway-role"
  description = "custom IAM Limited Role created with \"APIGateway\" as the trusted entity"
  path = "/"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "apigateway.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF

  tags = var.resourceTags
}

resource "aws_cloudwatch_log_group" "api_gateway_log_group" {
  name              = "/aws/lambda/${var.name}-api-gateway"
  retention_in_days = 14
}

resource "aws_iam_policy" "api_gateway_logging" {
  name        = "${var.name}-api-gateway-logging"
  path        = "/"
  description = "IAM policy for logging from the api gateway"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:GetLogEvents",
        "logs:FilterLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*",
      "Effect": "Allow"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "gateway_logs" {
  role       = aws_iam_role.iam_for_api_gateway.id
  policy_arn = aws_iam_policy.api_gateway_logging.arn
}

resource "aws_api_gateway_rest_api" "root_api" {
  name = "${var.name}-rest-api-service"

  tags = var.resourceTags
}

# at this point there are various resource "aws_api_gateway_resource" "api" blocks, etc

resource "aws_api_gateway_account" "demo" {
  cloudwatch_role_arn = aws_iam_role.iam_for_api_gateway.arn
}

resource "aws_api_gateway_deployment" "deployment" {
  rest_api_id   = aws_api_gateway_rest_api.root_api.id
  stage_name    = var.envName
  
  depends_on    = [
    aws_cloudwatch_log_group.api_gateway_log_group,
    aws_api_gateway_integration.lang_integration,
    aws_api_gateway_account.demo
  ]

  lifecycle {
    create_before_destroy = true
  }
}


resource "aws_api_gateway_method_settings" "example" {
  rest_api_id = aws_api_gateway_rest_api.root_api.id
  stage_name  = var.envName
  method_path = "*/*"

  settings {
    metrics_enabled = true
    logging_level   = "ERROR"
  }
}

但我没有看到为我的 API 网关生成任何日志条目，尽管日志组已创建。

我之前遇到过这个错误:

Error: updating API Gateway Stage failed: BadRequestException: CloudWatch Logs role ARN must be set in account settings to enable logging

  on ..\2-sub-modules\e-api-gateway\main.tf line 627, in resource "aws_api_gateway_method_settings" "example":
 627: resource "aws_api_gateway_method_settings" "example" {

但后来我更新了 resource "aws_api_gateway_method_settings""example" block (如上所示)。

现在，我没有收到上述错误，但我也没有收到任何 API 网关日志。

我错过了什么？

Answer 1

要解决“必须在帐户设置中设置 CloudWatch Logs 角色 ARN 才能启用日志记录”的问题，您应该在 API 网关帐户设置中指定此角色:

resource "aws_api_gateway_account" "demo" {
  cloudwatch_role_arn = aws_iam_role.cloudwatch.arn
}

resource "aws_iam_role" "cloudwatch" {
  name = "api_gateway_cloudwatch_global"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "apigateway.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

详情:https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_account