Question 1

Is cache_transit_encryption_enabled enforced for SOC 2?

Accepted Answer

Yes, This control checks whether an AWS AppSync API cache is encrypted in transit. The control fails if the API cache isn't encrypted in transit.

Question 2

Is log_field_log_level enforced for SOC 2?

Accepted Answer

Yes, This control checks whether an AWS AppSync API has field-level logging turned on. The control fails if the field resolver log level is set to None. Unless you provide custom parameter values to indicate that a specific log type should be enabled, Security Hub produces a passed finding if the field resolver log level is either ERROR or ALL.

AWS AppSync Terraform module

Terraform Module Source