Merge pull request #1 from codeforanchorage/tag-cloudwatch-log-groups

Tag CloudWatch log groups for mcp-observability discovery

Author: brendanbabb

terraform/aws/api_gateway.tf

@@ -132,12 +132,65 @@ resource "aws_api_gateway_deployment" "mcp_deployment" {
   ]
 }
 
+# API Gateway needs an account-level role to write logs to CloudWatch.
+# This is a per-region, per-account setting.
+
+resource "aws_iam_role" "api_gateway_cloudwatch" {
+  name = "${local.lambda_name}-apigw-cloudwatch"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Action = "sts:AssumeRole"
+      Effect = "Allow"
+      Principal = {
+        Service = "apigateway.amazonaws.com"
+      }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "api_gateway_cloudwatch" {
+  role       = aws_iam_role.api_gateway_cloudwatch.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
+}
+
+resource "aws_api_gateway_account" "this" {
+  cloudwatch_role_arn = aws_iam_role.api_gateway_cloudwatch.arn
+
+  depends_on = [aws_iam_role_policy_attachment.api_gateway_cloudwatch]
+}
+
+resource "aws_cloudwatch_log_group" "api_gateway_access_logs" {
+  name              = "/aws/apigateway/${local.lambda_name}-access"
+  retention_in_days = 14
+
+  tags = {
+    Project = "mcp-server"
+  }
+}
+
 resource "aws_api_gateway_stage" "stage" {
   deployment_id = aws_api_gateway_deployment.mcp_deployment.id
   rest_api_id   = aws_api_gateway_rest_api.mcp_api.id
   stage_name    = var.stage_name
 
   xray_tracing_enabled = true
+
+  access_log_settings {
+    destination_arn = aws_cloudwatch_log_group.api_gateway_access_logs.arn
+    format = jsonencode({
+      requestId      = "$context.requestId"
+      ip             = "$context.identity.sourceIp"
+      requestTime    = "$context.requestTime"
+      httpMethod     = "$context.httpMethod"
+      resourcePath   = "$context.resourcePath"
+      status         = "$context.status"
+      responseLength = "$context.responseLength"
+    })
+  }
+
+  depends_on = [aws_api_gateway_account.this]
 }
 
 resource "aws_api_gateway_method_settings" "mcp_post" {

terraform/aws/main.tf

@@ -91,4 +91,8 @@ resource "aws_lambda_function" "mcp_server" {
 resource "aws_cloudwatch_log_group" "lambda_logs" {
   name              = "/aws/lambda/${local.lambda_name}"
   retention_in_days = 14
+
+  tags = {
+    Project = "mcp-server"
+  }
 }