API Gateway - HTTP API CloudWatch Log Variables

Question

Hi,
I've build an architecture like below;
![Enter image description here](/media/postImages/original/IMiRuIUsnMSZGlihajYwGUng)

As you can see in the architecture, I can successfully return the PrincipalId value via Lambda Authorizer. However, according to the guidance in CloudWatch documentation, I cannot access the principalId value on logs with **$context.authorizer.principalId**. It comes as "-" continuously.
How can I get this data?

Thanks.

Answer

Thanks, 
When I check through IAM, I see that I have the necessary permissions.  Logs are below. Only **principalId** field always "-".
```
{
    "requestId": "U_wSVhG4l*******",
    "ip": "85.***.**.**",
    "requestTime": "21/Mar/2024:20:09:50 +0000",
    "httpMethod": "GET",
    "routeKey": "ANY /{proxy+}",
    "status": "200",
    "protocol": "HTTP/1.1",
    "responseLength": "87",
    "path": "/***/***/***",
    "reqLatency": "107 ms",
    "resLatency": "109 ms",
    "userAgent": "***",
    "principalId": "-"
}
```

Answer

Make sure that the IAM role associated with your API Gateway has permissions to write to CloudWatch Logs (e.g., the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents actions

API Gateway - HTTP API CloudWatch Log Variables

Relevant content