fix errors

- CloudWatch Logs role ARN must be set in account settings to enable logging
ksmin23 · Sep 8, 2024 · 470b6c8 · 470b6c8
1 parent 35d41ce
commit 470b6c8
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 0 deletions.
diff --git a/api-gateway/logging-api-calls-to-cloudwatch-logs/cdk_stacks/apigw.py b/api-gateway/logging-api-calls-to-cloudwatch-logs/cdk_stacks/apigw.py
@@ -46,6 +46,21 @@ def __init__(self, scope: Construct, construct_id: str, lambda_fn, **kwargs) ->
       }
     )
 
+    #XXX: CloudWatch Logs role ARN must be set in account settings to enable logging
+    cloudwatch_role = aws_iam.Role(self, 'ApiGatewayCloudWatchRole',
+      assumed_by=aws_iam.ServicePrincipal('apigateway.amazonaws.com'),
+      managed_policies=[
+        aws_iam.ManagedPolicy.from_aws_managed_policy_name('service-role/AmazonAPIGatewayPushToCloudWatchLogs')
+      ]
+    )
+    cloudwatch_role.apply_removal_policy(cdk.RemovalPolicy.DESTROY)
+
+    #XXX: CloudWatch Logs role ARN must be set in account settings to enable logging
+    apigw_account = aws_apigateway.CfnAccount(self, 'ApiGatewayAccount',
+      cloud_watch_role_arn=cloudwatch_role.role_arn
+    )
+    apigw_account.apply_removal_policy(cdk.RemovalPolicy.DESTROY)
+
     random_gen_api_log_group = aws_logs.LogGroup(self, 'RandomGenApiLogs')
 
     cwl_subscription_filter = aws_logs.CfnSubscriptionFilter(self, 'CWLSubscriptionFilter',

diff --git a/api-gateway/logging-api-calls-to-firehose/cdk_stacks/apigw.py b/api-gateway/logging-api-calls-to-firehose/cdk_stacks/apigw.py
@@ -37,6 +37,21 @@ def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
       timeout=cdk.Duration.minutes(5)
     )
 
+    #XXX: CloudWatch Logs role ARN must be set in account settings to enable logging
+    cloudwatch_role = aws_iam.Role(self, 'ApiGatewayCloudWatchRole',
+      assumed_by=aws_iam.ServicePrincipal('apigateway.amazonaws.com'),
+      managed_policies=[
+        aws_iam.ManagedPolicy.from_aws_managed_policy_name('service-role/AmazonAPIGatewayPushToCloudWatchLogs')
+      ]
+    )
+    cloudwatch_role.apply_removal_policy(cdk.RemovalPolicy.DESTROY)
+
+    #XXX: CloudWatch Logs role ARN must be set in account settings to enable logging
+    apigw_account = aws_apigateway.CfnAccount(self, 'ApiGatewayAccount',
+      cloud_watch_role_arn=cloudwatch_role.role_arn
+    )
+    apigw_account.apply_removal_policy(cdk.RemovalPolicy.DESTROY)
+
     random_gen_api_log_group = aws_logs.LogGroup(self, 'RandomGenApiLogs')
 
     #XXX: Using aws_apigateway.AccessLogFormat.custom(json.dumps({..}))