AWS API Gateway — configured access JSON
AWS API Gateway — configured access JSON. Access log object generated by a configured context-variable template.
Source and collection
API Gateway stage access log destination.
Preserve the exact access log template and stage configuration.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 1
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: f25f2373d2cfa77d1389225c7c46de1718397af7814fa5754ee93db8952d44c4
{"requestId":"GQIVriFLIAMEMsA=","ip":"1.128.0.0","requestTime":"09/Jun/2023:12:54:08 +0000","httpMethod":"GET","routeKey":"GET /","status":"200","protocol":"HTTP/1.1","responseLength":"47140"}
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
requestId | str |
ip | str |
requestTime | str |
httpMethod | str |
routeKey | str |
status | str |
protocol | str |
responseLength | str |
- requestId
- Native field; inspect its exact type and nesting in the complete example below.
- httpMethod
- Native field; inspect its exact type and nesting in the complete example below.
- routeKey
- Native field; inspect its exact type and nesting in the complete example below.
- status
- Native field; inspect its exact type and nesting in the complete example below.
Investigation uses
- Correlate requestId, method, route, status and latency with backend evidence.
- Retain resource, account/project/subscription and region context for correlation.
Validation boundaries
There is no single universal access-log JSON schema; this fixture represents one selected template.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.