Check Details

• Resource: VPC
• Check: Ensure VPC flow logs are enabled
• Risk: Lack of flow logs can obscure network issues and security events

Remediation via AWS Console

1. Sign into the AWS Management Console and open VPC.

   

2. In the left navigation panel, select Your VPCs and choose a VPC.

   

3. In the right panel, go to the Flow Logs tab. If no flow log exists, click Create Flow Log.

   

4. For Filter, select Reject.

   

5. Enter an IAM Role and Destination Log Group, then click Create Flow Log.

   

6. Verify logs in CloudWatch: CloudWatch → Logs → Log groups.

   

Remediation via AWS CLI

1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.

   

2. Create a file role_policy_document.json with the following content:

   

   nano role_policy_document.json
   

   Paste the following content. ctrl+O -> save and ctrl+X -> exit.

   

   {
   "Version": "2012-10-17",
   "Statement": [
   {
   "Sid": "AllowVPCFlowLogsAssumeRole",
   "Effect": "Allow",
   "Principal": {
   "Service": "vpc-flow-logs.amazonaws.com"
   },
   "Action": "sts:AssumeRole"
   }
   ]
   }
   

3. Create a file iam_policy.json with the following content:

   

   nano iam_policy.json
   

   Paste the following content. ctrl+O -> save and ctrl+X -> exit.

   

   {
   "Version": "2012-10-17",
   "Statement": [
   {
   "Effect": "Allow",
   "Action": [
   "logs:CreateLogGroup",
   "logs:CreateLogStream",
   "logs:DescribeLogGroups",
   "logs:DescribeLogStreams",
   "logs:PutLogEvents",
   "logs:GetLogEvents",
   "logs:FilterLogEvents"
   ],
   "Resource": "\*"
   }
   ]
   }
   

4. Create the IAM Role:

   

   aws iam create-role --role-name vpc-flow-logs-role --assume-role-policy-document file://role_policy_document.json
   

5. Create the IAM Policy:

   

   aws iam create-policy --policy-name vpc-flow-logs-policy --policy-document file://iam_policy.json
   

6. Attach the policy to the IAM role:

   

   aws iam attach-role-policy --role-name vpc-flow-logs-role --policy-arn arn:aws:iam::<aws-account-id>:policy/vpc-flow-logs-policy
   

7. Identify VPCs in the region:

   

   aws ec2 describe-vpcs --region <region>
   

8. Create Flow Logs for each VPC:

   

   aws ec2 create-flow-logs \
   --resource-type VPC \
   --resource-ids <vpc-id> \
   --traffic-type ALL \
   --log-group-name <log-group-name> \
   --deliver-logs-permission-arn arn:aws:iam::<aws-account-id>:role/vpc-flow-logs-role
   

9. Repeat for all remaining VPCs in the region. Update --region accordingly for other regions.