Rule: VPC Flow Logs Should Be Enabled

Rule Description:

Troubleshooting Steps (if applicable):

2. 1.
   Check if the necessary permissions are assigned to enable VPC flow logs.
4. 2.
   Verify if the VPC flow log destination is properly configured.
6. 3.
   Ensure that the appropriate log group is created in Amazon CloudWatch Logs.
8. 4.
   Check for any errors or warnings in CloudTrail logs that could be preventing VPC flow log enablement.

Configuration Code (if applicable):

aws ec2 create-flow-logs --resource-type VPC --resource-ids vpc-12345678 --traffic-type ALL --log-destination-type cloud-watch-logs --log-destination user-flow-logs --log-format-version 2

Remediation Steps:

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Open the Amazon VPC service.
6. 3.
   In the left navigation pane, click on "Your VPCs."
8. 4.
   Select the desired VPC for which you want to enable flow logs.
10. 5.
    Click on the "Flow Logs" tab at the bottom.
12. 6.
    Click on the "Create Flow Log" button.
14. 7.
    Configure the following settings:

    • Log Destination: Choose an existing CloudWatch Logs group or create a new one.
    • IAM Role: Specify an IAM role with the necessary permissions for creating flow logs.
    • Filter: Choose the desired traffic types to be logged (e.g., All, Accept, Reject, etc.).
    • Log Format: Select the desired log format (version 2 is recommended).
16. 8.
    Click on the "Create" button to enable flow logs for the selected VPC.

CLI Command:

aws ec2 create-flow-logs --resource-type VPC --resource-ids <VPC_ID> --traffic-type ALL --log-destination-type cloud-watch-logs --log-destination <LOG_GROUP_NAME> --log-format-version 2

<VPC_ID>

<LOG_GROUP_NAME>