AppSync GraphQL APIs should have field-level logging enabled

Field-level logging in AppSync captures resolver execution details, including request mappings, response mappings, and errors at the individual field level. Without it, you lose visibility into which resolvers are failing, how long they take, and what data they return. This makes debugging production issues slow and leaves you blind to data exfiltration patterns or injection attempts against your GraphQL API.

AppSync APIs often sit in front of multiple data sources (DynamoDB, Lambda, RDS) and act as an aggregation layer. A single GraphQL query can fan out to dozens of resolvers. Logging at the API level alone won't tell you which resolver misbehaved. Field-level logs sent to CloudWatch give you the granularity needed for both operational troubleshooting and security investigations.

Implementation

Choose the approach that matches how you manage Terraform.

module "appsync" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/appsync/aws"
  version = ">=3.0.0"

  authentication_type = "AWS_IAM"
  log_field_log_level = "ERROR"
  logging_enabled     = true
  name                = "pofix-abc123"
  schema              = "type Query { hello: String }"
}

module "appsync" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/appsync/aws"
  version = ">=3.0.0"

  authentication_type = "AWS_IAM"
  log_field_log_level = "ERROR"
  logging_enabled     = true
  name                = "pofix-abc123"
  schema              = "type Query { hello: String }"
}

module "appsync" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/appsync/aws"
  version = ">=3.0.0"

  authentication_type = "AWS_IAM"
  log_field_log_level = "ERROR"
  logging_enabled     = true
  name                = "pofix-abc123"
  schema              = "type Query { hello: String }"
}

module "appsync" {
  source  = "terraform-aws-modules/appsync/aws"
  version = ">=3.0.0"

  authentication_type = "AWS_IAM"
  log_field_log_level = "ERROR"
  logging_enabled     = true
  name                = "pofix-abc123"
  schema              = "type Query { hello: String }"
}

resource "aws_appsync_graphql_api" "this" {
  authentication_type = "AWS_IAM"

  log_config {
    cloudwatch_logs_role_arn = "arn:aws:iam::123456789012:role/example-role"
    field_log_level          = "ERROR"
  }

  name = "pofix-abc123"
}

What this control checks

The aws_appsync_graphql_api resource passes when its log_config block sets field_log_level to "ERROR" or "ALL". It fails when field_log_level is "NONE" or the log_config block is absent entirely. log_config also requires a cloudwatch_logs_role_arn pointing to an IAM role with permissions to write to CloudWatch Logs: a trust policy allowing appsync.amazonaws.com to assume the role, and an attached policy granting logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Without that role, the API cannot deliver logs even if the log level is set correctly.

Common pitfalls

Audit evidence

Config rule evaluation results showing each AppSync API as compliant, or Security Hub findings with PASSED status for this control, are the primary audit artifacts. Supporting those, the associated CloudWatch Logs log group should contain recent field-level log entries, confirming that logging is actively functioning and not just configured.

The AppSync API settings page in the AWS Console shows the current logging configuration, including the field resolver log level and the associated IAM role ARN. CLI output from aws appsync get-graphql-api --api-id <id> showing fieldLogLevel as ERROR or ALL in the logConfig object provides direct proof.

Related controls

• CodeBuild projects should have logging enabled

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf Control: appsync_graphql_api_field_level_logging_enabled

• AWS Config Managed Rule: APPSYNC_LOGGING_ENABLED

• Checkov Checks: CKV_AWS_193, CKV_AWS_194

• Powerpipe Control: aws_compliance.control.appsync_graphql_api_field_level_logging_enabled

• Prowler Check: appsync_field_level_logging_enabled

• AWS Security Hub Control: AppSync.2

Last reviewed: 2026-03-08