# 3.7 Ensure VPC flow logging is enabled in all VPCs - Source: https://support.icompaas.com/support/solutions/articles/62000233162-3-7-ensure-vpc-flow-logging-is-enabled-in-all-vpcs - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 3](https://support.icompaas.com/support/solutions/folders/62000169197) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 2** ## **Description:** AWS VPC Flow Logs capture IP traffic flowing to and from network interfaces in a VPC. These logs help in security monitoring, compliance, and forensic investigations. The logs are stored in Amazon CloudWatch Logs and can be analyzed for potential security threats.Enabling VPC Flow Logs ensures visibility into rejected network traffic, helping detect suspicious activity and unauthorized access attempts. ## Rationale: Detects potential threats by logging rejected traffic (e.g., unauthorized access attempts, scanning activity).Improves incident response by providing forensic evidence in case of a security breach.Supports compliance with PCI DSS, SOC 2, ISO 27001, NIST, and CIS benchmarks.Assists in troubleshooting by identifying unexpected traffic patterns.Without VPC Flow Logs, security teams lack network visibility, making it difficult to detect and analyze threats. ## Impact: - Provides full visibility into VPC network traffic. - Helps detect malicious activity and unauthorized access. - Essential for forensic analysis and incident response. - Supports compliance with security standards. ## ## Default Value: - VPC Flow Logs are NOT enabled by default. - Must be manually enabled for each VPC. ## Pre-Requisites: IAM permissions required: - ec2:DescribeVpcs - ec2:CreateFlowLogs - iam:CreateRole - iam:AttachRolePolicy - logs:CreateLogGroup - logs:PutRetentionPolicy  AWS CLI installed for automation. ## Remediation: ### Test Plan: ## Using AWS Console Step 1: Check If VPC Flow Logs Are Enabled 1. Sign in to the AWS Management Console 2. Go to VPC Dashboard → [AWS VPC](https://console.aws.amazon.com/vpc) ![](https://support.icompaas.com/assets/kb/73222d38776c63b1.png) 3. Click Your VPCs in the left navigation panel       ![](https://support.icompaas.com/assets/kb/a0bb3ed2367abb3c.png) 4. Select a VPC       ![](https://support.icompaas.com/assets/kb/414730da5a4d2864.png) 5. Click on the Flow Logs tab      ![](https://support.icompaas.com/assets/kb/1afaa98e0df57d07.png) 6. Ensure a log flow exists and has the Status as Active                   ![](https://support.icompaas.com/assets/kb/f2e73041231a2d19.png) 7. Repeat for all VPCs in all AWS regions - **If logs exist and are active, VPC Flow Logs are enabled.** - **If no logs exist, follow the remediation steps.** ## ## **Using AWS CLI** **Step 1: List All VPCs** aws ec2 describe-vpcs --query 'Vpcs\[\*\].VpcId' **Step 2: Check If Flow Logs Exist for Each VPC** aws ec2 describe-flow-logs --filter "Name=resource-id,Values=" **Implementation Steps:** ## **Using AWS Console** **Step 1: Enable Flow Logs for a VPC** 1. **Sign in to the AWS Management Console** 2. **Navigate to VPC Dashboard → [AWS VPC](https://console.aws.amazon.com/vpc)** **![](https://support.icompaas.com/assets/kb/d5e7526bc296bc18.png)** 3. Click Your VPCs in the left navigation panel     **![](https://support.icompaas.com/assets/kb/beb07d94fb4a6c3e.png)** 4. **Select a** VPC    **![](https://support.icompaas.com/assets/kb/ab1e10cf496078f3.png)** 5. Click on the Flow Logs **tab**    **![](https://support.icompaas.com/assets/kb/dc6b9fe4d7fdde9c.png)** 6. Click Create Flow Log     **![](https://support.icompaas.com/assets/kb/3a1d1aa0bdcc6ed6.png)** 7. **Configure the log:** - **Filter: Reject (to log only rejected traffic)** - **Destination Log Group: Select or create an Amazon CloudWatch Log Group** - **IAM Role: Select or create an IAM role for log delivery**                                            **![](https://support.icompaas.com/assets/kb/a93634115cc28d21.png)** 8. Click Create Log Flow     **![](https://support.icompaas.com/assets/kb/30fde85bba3ae554.png)** 9. Click on CloudWatch Logs Group **to verify logs** ## **Using AWS CLI** **Step 1: Create IAM Role for Log Delivery** aws iam create-role --role-name VPCFlowLogsRole --assume-role-policy-document file://trust-policy.json **Step 2: Create a CloudWatch Log Group** aws logs create-log-group --log-group-name VPC-Flow-Logs **Step 3: Create VPC Flow Logs** aws ec2 create-flow-logs \\ --resource-type VPC \\ --resource-ids \\ --traffic-type REJECT \\ --log-group-name VPC-Flow-Logs \\ --deliver-logs-permission-arn arn:aws:iam::123456789012:role/VPCFlowLogsRole ## **Backout Plan** **If enabling VPC Flow Logs causes issues:** **Delete VPC Flow Logs via AWS CLI**  aws ec2 delete-flow-logs --flow-log-ids **Verify Logs Are Disabled**  aws ec2 describe-flow-logs --filter "Name=resource-id,Values=" **If the command returns \[\], logs are disabled.** ## ## **References:** - **[](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html)**[](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html)[AWS VPC Flow Logs Guide](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html)[](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html)**[](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html)** - **[](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-flow-logs.html)**[](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-flow-logs.html)[AWS CLI Reference (VPC Flow Logs)](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-flow-logs.html)[](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-flow-logs.html)**[](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-flow-logs.html)** ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.