title: Terraform API Gateway HTTP API - Getting the error Insufficient permissions to enable logging
body: <p>My terraform script for deploying an HTTP API looks like the following. I am getting the following error when I run this -</p>
  <p>error creating API Gateway v2 stage: BadRequestException: Insufficient permissions to enable logging</p>
  <p>Do I need to add something else to make it work?</p>
  <pre><code>resource &quot;aws_cloudwatch_log_group&quot; &quot;api_gateway_log_group&quot; {
    name              = &quot;/aws/apigateway/${var.location}-${var.custom_tags.Layer}-demo-publish-api&quot;
    retention_in_days = 7
    tags = var.custom_tags
  }
  
  resource &quot;aws_apigatewayv2_api&quot; &quot;demo_publish_api&quot; {
    name = &quot;${var.location}-${var.custom_tags.Layer}-demo-publish-api&quot;
    description = &quot;API to publish event payloads&quot;
    protocol_type = &quot;HTTP&quot;
    tags = var.custom_tags
  }
  
  resource &quot;aws_apigatewayv2_vpc_link&quot; &quot;demo_vpc_link&quot; {
    name = &quot;${var.location}-${var.custom_tags.Layer}-demo-vpc-link&quot;
    security_group_ids = local.security_group_id_list
    subnet_ids = local.subnet_ids_list
    tags = var.custom_tags
  }
  
  resource &quot;aws_apigatewayv2_integration&quot; &quot;demo_apigateway_integration&quot; {
    api_id           = aws_apigatewayv2_api.demo_publish_api.id
    integration_type = &quot;HTTP_PROXY&quot;
    connection_type = &quot;VPC_LINK&quot;
    integration_uri = var.alb_listener_arn
    connection_id = aws_apigatewayv2_vpc_link.demo_vpc_link.id
    integration_method = &quot;POST&quot;
    timeout_milliseconds = var.api_timeout_milliseconds
  }
  
  resource &quot;aws_apigatewayv2_route&quot; &quot;demo_publish_api_route&quot; {
    api_id    = aws_apigatewayv2_api.demo_publish_api.id
    route_key = &quot;POST /api/event&quot;
    target = &quot;integrations/${aws_apigatewayv2_integration.demo_apigateway_integration.id}&quot;
  }
  
  resource &quot;aws_apigatewayv2_stage&quot; &quot;demo_publish_api_default_stage&quot; {
    depends_on = [aws_cloudwatch_log_group.api_gateway_log_group]
  
    api_id = aws_apigatewayv2_api.demo_publish_api.id
    name   = &quot;$default&quot;
    auto_deploy = true
    tags = var.custom_tags
  
    route_settings {
      route_key = aws_apigatewayv2_route.demo_publish_api_route.route_key
      throttling_burst_limit = var.throttling_burst_limit
      throttling_rate_limit = var.throttling_rate_limit
    }
  
    default_route_settings {
      detailed_metrics_enabled = true
      logging_level = &quot;INFO&quot;
    }
  
    access_log_settings {
      destination_arn = aws_cloudwatch_log_group.api_gateway_log_group.arn
      format = jsonencode({ &quot;requestId&quot;:&quot;$context.requestId&quot;, &quot;ip&quot;: &quot;$context.identity.sourceIp&quot;})
    }
  }
  </code></pre>