creating-api-gateway-stage

Create the stage with aws apigateway create-stage, then configure an IAM role with the AmazonAPIGatewayPushToCloudWatchLogs policy and set it as the account cloudwatchRoleArn. Finally enable access and execution logging via update-stage patch operations on the stage.

Create a WAFv2 web ACL with REGIONAL scope and managed rule groups like AWSManagedRulesCommonRuleSet, then associate it using aws wafv2 associate-web-acl with the stage resource ARN. The procedure also adds a rate-based rule to prevent abuse.

Missing logs usually mean the CloudWatch IAM role lacks permissions, the log group does not exist, or logging is not enabled at both stage and method levels. Verify the account cloudwatchRoleArn and the /*/*/logging/loglevel method setting.

The procedure defaults to a rate limit of 1000 requests per second and a burst limit of 2000, applied via update-stage patch operations on /*/*/throttling paths. Adjust these values based on your account limits and expected traffic patterns.

Yes, authorization can be configured at any time after stage creation. Options include NONE, IAM, API keys, Lambda authorizers, or custom authorizers, with IAM, API keys, or Lambda recommended for production environments.