VPC must have flow logs enabled

High AWS General aws-ec2-vpc-vpc-flow-logs-enabled

Applies to

AWS::EC2::VPC

What CGPulse checks

A resource passes this rule when flowLogsEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable flow logs to analyze network traffic for security threats. In AWS Console: VPC > Flow logs > Create flow log. See: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

CLI

aws ec2 create-flow-logs --resource-type VPC --resource-ids "{id}" --traffic-type ALL --log-destination-type cloud-watch-logs --log-group-name vpc-flow-logs

Terraform

resource "aws_flow_log" "{name}" {
  vpc_id          = "{id}"
  traffic_type    = "ALL"
  log_destination = aws_cloudwatch_log_group.{name}.arn
  iam_role_arn    = aws_iam_role.flow_log.arn
}

Compliance frameworks

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan