Description

Ensure that VPC Flow Logs are enabled for every Amazon VPC in use. Flow logs capture information about the IP traffic going to and from the network interfaces in the VPC and deliver the records to Amazon S3, Amazon CloudWatch Logs or Amazon Data Firehose. A VPC is in use when it has at least one network interface; VPCs without network interfaces are not evaluated. Only the presence of a flow log for the VPC is checked, and the delivery status of the flow log is not verified.

Rationale

Without flow logs, network activity in the VPC is not recorded, which makes it difficult to detect and investigate malicious traffic. Attackers can probe resources, move laterally or exfiltrate data unnoticed, and outages or misconfigurations are harder to diagnose. Enabling flow logs for all VPCs, at least for rejected traffic and preferably for all traffic, and sending them to a central, access-controlled destination with defined retention provides baseline network telemetry for monitoring and incident response.

Impact

  • Provides a record of accepted and rejected network traffic for security monitoring and troubleshooting

  • Supports incident investigation and threat detection services

  • Flow logs do not affect network throughput or latency

  • Log delivery and storage incur charges that grow with the volume of traffic

Default Value

Flow logs are not enabled by default for new VPCs.

Pre-Requisites

  • IAM permissions: ec2:DescribeVpcs, ec2:DescribeFlowLogs, ec2:DescribeNetworkInterfaces, ec2:CreateFlowLogs and ec2:DeleteFlowLogs

  • For an S3 destination: an S3 bucket for the logs and permission to update its bucket policy (s3:GetBucketPolicy, s3:PutBucketPolicy) and logs:CreateLogDelivery, so that AWS can add the required delivery permissions

  • For a CloudWatch Logs destination: a log group and an IAM role that allows the flow logs service to publish to it

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon VPC console and select Your VPCs.

  3. Select a VPC and open the Flow logs tab.

  4. Check that at least one flow log exists.

  5. Repeat for each VPC in each region in use.

  6. If a VPC that contains resources has no flow log, follow the implementation steps.

CLI:

List the VPCs in a region:

aws ec2 describe-vpcs --region <REGION> --query "Vpcs[].[VpcId,CidrBlock]" --output table

Check whether a VPC is in use (has network interfaces):

aws ec2 describe-network-interfaces --region <REGION> --filters Name=vpc-id,Values=<VPC_ID> --query "NetworkInterfaces[].NetworkInterfaceId"

Show the flow logs of a VPC:

aws ec2 describe-flow-logs --region <REGION> --filter Name=resource-id,Values=<VPC_ID> --query "FlowLogs[].[FlowLogId,FlowLogStatus,TrafficType,LogDestinationType]" --output table

A VPC fails if it has at least one network interface and no flow log is returned for it. VPCs without network interfaces are not evaluated, and the FlowLogStatus and delivery of an existing flow log are not verified.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon VPC console and select Your VPCs.

  3. Select the VPC and open the Flow logs tab.

  4. Choose Create flow log.

  5. Set Filter to All (or at least Reject).

  6. Select the destination and enter its details:

    • for Amazon S3, enter the bucket ARN, for example arn:aws:s3:::<S3_BUCKET_NAME>,

    • for CloudWatch Logs, select the log group and the IAM role.

  7. Choose Create flow log.

  8. Repeat for each affected VPC in each region in use.

CLI:

Create a flow log that sends all traffic records to an S3 bucket:

aws ec2 create-flow-logs --region <REGION> --resource-type VPC --resource-ids <VPC_ID> --traffic-type ALL --log-destination-type s3 --log-destination arn:aws:s3:::<S3_BUCKET_NAME>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon VPC console and select Your VPCs.

  3. Select the VPC and open the Flow logs tab.

  4. Select the flow log created during implementation, choose Actions, then Delete flow logs, and confirm.

CLI:

aws ec2 delete-flow-logs --region <REGION> --flow-log-ids <FLOW_LOG_ID>

Note: rolling back stops recording network traffic for the VPC. Log records already delivered remain at the destination.

Reference