add logging

api.tf

@@ -11,7 +11,16 @@ resource "aws_apigatewayv2_stage" "default" {
   api_id = aws_apigatewayv2_api.this.id
   name   = "default"
 
-  tags = local.tags
+  default_route_settings {
+    logging_level = "INFO"
+  }
+
+  /*
+  access_log_settings {
+    destination_arn = "arn:aws:logs:us-east-1:123456789012:log-group:/aws/api-gateway/example-api"
+    format          = "{\"requestId\":\"$context.requestId\",\"ip\":\"$context.identity.sourceIp\",\"requestTime\":\"$context.requestTime\",\"httpMethod\":\"$context.httpMethod\",\"resourcePath\":\"$context.routeKey\",\"status\":\"$context.status\",\"responseLength\":\"$context.responseLength\"}"
+  }
+  */
 }
 
 resource "aws_apigatewayv2_integration" "connect-integration" {

logs.tf

@@ -0,0 +1,25 @@
+resource "aws_api_gateway_account" "this" {
+  cloudwatch_role_arn = aws_iam_role.api-gateway-cloudwatch-role.arn
+}
+
+resource "aws_iam_role" "api-gateway-cloudwatch-role" {
+  name = local.resource_name
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Action = "sts:AssumeRole",
+        Effect = "Allow",
+        Principal = {
+          Service = "apigateway.amazonaws.com"
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "logs" {
+  role       = aws_iam_role.api-gateway-cloudwatch-role.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
+}