Tag CloudWatch log groups for mcp-observability discovery

Add Project = "mcp-server" tag to the Lambda log group so the separate
mcp-observability project can discover it via the Resource Groups Tagging
API.

The API Gateway access log group did not previously exist, so this also
adds the supporting infrastructure to make access logging work:
- aws_cloudwatch_log_group.api_gateway_access_logs (tagged)
- access_log_settings block on the stage pointing at it
- aws_api_gateway_account + IAM role, the account-level prerequisite
  API Gateway needs to write logs to CloudWatch

Tags only take effect on the real resources after a deploy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: brendanbabb

terraform/aws/api_gateway.tf

@@ -132,12 +132,65 @@ resource "aws_api_gateway_deployment" "mcp_deployment" {
   ]
 }
 
+# API Gateway needs an account-level role to write logs to CloudWatch.
+# This is a per-region, per-account setting.
+
+resource "aws_iam_role" "api_gateway_cloudwatch" {
+  name = "${local.lambda_name}-apigw-cloudwatch"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Action = "sts:AssumeRole"
+      Effect = "Allow"
+      Principal = {
+        Service = "apigateway.amazonaws.com"
+      }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "api_gateway_cloudwatch" {
+  role       = aws_iam_role.api_gateway_cloudwatch.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
+}
+
+resource "aws_api_gateway_account" "this" {
+  cloudwatch_role_arn = aws_iam_role.api_gateway_cloudwatch.arn
+
+  depends_on = [aws_iam_role_policy_attachment.api_gateway_cloudwatch]
+}
+
+resource "aws_cloudwatch_log_group" "api_gateway_access_logs" {
+  name              = "/aws/apigateway/${local.lambda_name}-access"
+  retention_in_days = 14
+
+  tags = {
+    Project = "mcp-server"
+  }
+}
+
 resource "aws_api_gateway_stage" "stage" {
   deployment_id = aws_api_gateway_deployment.mcp_deployment.id
   rest_api_id   = aws_api_gateway_rest_api.mcp_api.id
   stage_name    = var.stage_name
 
   xray_tracing_enabled = true
+
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.api_gateway_access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      responseLength = "$context.responseLength"
+    })
+  }
+
+  depends_on = [aws_api_gateway_account.this]
 }
 
 resource "aws_api_gateway_method_settings" "mcp_post" {

terraform/aws/main.tf

@@ -91,4 +91,8 @@ resource "aws_lambda_function" "mcp_server" {
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   name              = "/aws/lambda/${local.lambda_name}"
   retention_in_days = 14
+
+  tags = {
+    Project = "mcp-server"
+  }
 }