API Gateway access log still get requests blocked by WAF
Hi there, I have an API Gateway with the access logging enabled (logs are streamed to Firehose). I have noticed that the requests blocked by WAF are streamed to Firehose too (I wasn't expecting that). My understanding was that when WAF blocks a request, this will not be forwarded any further but if the API Gateway log is written I assume that the request reaches it, isn't it?
If this is the correct behavior, is there a way to filter out some access logs to be streamed to firehose?
When you enable WAF for API Gateway, WAF is not located in front of the Gateway but rather on the side, i.e., the request is always received by API Gateway, if WAS is enabled, API Gateway sends the request to WAF and based on the result it decides if to continue processing the request and send it to the backend integration or send an error message back to the client.
It will look like this (forgive my drawing capabilities):
Client -> API Gateway -> Backend | ^ V | WAF
I'm not quite sure if there can be filtering enabled for logs with APIGW, but with WAF you can do filtering. In the sense that you can only logs BLOCK requests. You can also do redaction of HTTP Requests Headers that you may deem sensitive to be stored such as auth headers, etc.
API Gateway access log still get requests blocked by WAFasked 3 months ago
Is there something happening with API Gateway access logs?asked 7 months ago
API Gateway not forwarding all access logs to Cloudwatchasked 2 years ago
Signing requests with Cognito token to API Gateway necessary?asked 4 months ago
Api Gateway with Lambda Integration Failureasked 6 months ago
Billing on Api Gateway after Waf deny requestsasked 5 months ago
Access lambda in custom VPC from public API GatewayAccepted Answerasked 5 months ago
limits with API gateway custom authorizer for number of requestsAccepted Answerasked 2 years ago
API Gateway CORS error after update aws-cdk update to 1.135.0asked 4 months ago
Unable to authorize requests to API Gateway using Cognito access tokenasked 2 years ago