AWS Security ChangesHomeSearch

AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2026-04-01 · Documentation low

File: AWSCloudFormation/latest/TemplateReference/aws-properties-appsync-graphqlapi-logconfig.md

Summary

Changed the 'RoleArn' and 'FieldLogLevel' properties from optional to required in the AppSync GraphQL API LogConfig configuration.

Security assessment

The change enforces that logging configuration must be explicitly provided when setting up AppSync GraphQL API logging. This improves security posture by ensuring audit trails are not accidentally omitted, but there is no evidence in the diff that this change addresses a specific, disclosed security vulnerability or incident.

Diff

diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-appsync-graphqlapi-logconfig.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-appsync-graphqlapi-logconfig.md
index edfb9edcb..899409b69 100644
--- a//AWSCloudFormation/latest/TemplateReference/aws-properties-appsync-graphqlapi-logconfig.md
+++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-appsync-graphqlapi-logconfig.md
@@ -42 +42 @@ The service role that AWS AppSync will assume to publish to Amazon CloudWatch Lo
-_Required_ : No
+_Required_ : Yes
@@ -99 +99 @@ The field logging level. Values can be NONE, ERROR, INFO, DEBUG, or ALL.
-_Required_ : No
+_Required_ : Yes