Add cloudwatch logging - api gateway global settings

iam.tf

@@ -0,0 +1,23 @@
+module "apigw_cwl_role" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
+  version = "~> 5.9.2"
+
+  trusted_role_services = [
+    "apigateway.amazonaws.com"
+  ]
+
+  create_role = var.enable_global_apigw_logging
+
+  role_name_prefix  = "apigw-cwl-global"
+  role_requires_mfa = false
+
+  custom_role_policy_arns = [
+    "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs",
+  ]
+}
+
+resource "aws_api_gateway_account" "api_gateway_account" {
+  count = var.enable_global_apigw_logging ? 1 : 0
+
+  cloudwatch_role_arn = module.apigw_cwl_role.iam_role_arn
+}

main.tf

@@ -45,6 +45,10 @@ resource "aws_api_gateway_stage" "stage" {
     format          = jsonencode(var.log_format)
   }
 
+  tags = {
+    global_cwl_log_arn = var.enable_global_apigw_logging ? aws_api_gateway_account.api_gateway_account[0].cloudwatch_role_arn : ""
+  }
+
 }
 
 resource "aws_cloudwatch_log_group" "log_group" {

variables.tf

@@ -131,3 +131,9 @@ variable "vpc_links" {
   )
   default = {}
 }
+
+variable "enable_global_apigw_logging" {
+  description = "Enable global apigw logging"
+  type        = bool
+  default     = false
+}