Network Firewall Logging Should Be Enabled

More Info:

Ensure network firewall logging is enabled

Risk Level

Medium

Address

Operational Maturity, Reliability, Security

Compliance Standards

CBP,GDPR,HIPAA,ISO27001,SEBI

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration of network firewall logging not being enabled for AWS EC2 instances using AWS CLI, follow these steps:

Enable VPC Flow Logs: VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC. Run the following AWS CLI command to enable VPC Flow Logs for your VPC:

aws ec2 create-flow-logs --resource-type VPC --resource-ids <your-vpc-id> --traffic-type ALL --log-group-name <your-log-group-name> --deliver-logs-permission-arn <your-iam-role-arn>

Replace <your-vpc-id> with the ID of your VPC, <your-log-group-name> with the name of the CloudWatch Logs group where the flow logs will be stored, and <your-iam-role-arn> with the ARN of the IAM role that has permission to publish logs to CloudWatch Logs.

Enable Security Group Logging: Security Group Logs provide detailed information about the traffic allowed or denied by security groups associated with your EC2 instances. Run the following AWS CLI command to enable security group logging:

aws ec2 create-flow-logs --resource-type NetworkInterface --resource-ids <your-network-interface-id> --traffic-type ALL --log-group-name <your-log-group-name> --deliver-logs-permission-arn <your-iam-role-arn>

Replace <your-network-interface-id> with the ID of the network interface associated with your EC2 instance.

Verify Configuration: Once you have enabled VPC Flow Logs and Security Group Logs, verify that the logs are being generated and stored in the specified CloudWatch Logs group. You can do this by checking the CloudWatch Logs console or by using the AWS CLI to query the logs.

By following these steps, you can successfully remediate the misconfiguration of network firewall logging not being enabled for AWS EC2 instances using AWS CLI.

Using Python

To remediate the network firewall logging misconfiguration for AWS EC2 using Python, you can follow these steps:

Import the necessary libraries:

import boto3

Initialize the AWS EC2 client:

ec2 = boto3.client('ec2')

Enable VPC Flow Logs for the desired VPC:

response = ec2.create_flow_logs(
    DeliverLogsPermissionArn='arn:aws:iam::123456789012:role/flow-logs-role',
    ResourceIds=['vpc-12345678'],
    ResourceType='VPC',
    TrafficType='ALL',
    LogDestinationType='cloud-watch-logs',
    LogDestination='arn:aws:logs:us-east-1:123456789012:log-group:flow-logs',
)

Replace the DeliverLogsPermissionArn, ResourceIds, and LogDestination with your specific values.

Verify that the VPC Flow Logs have been enabled successfully:

response = ec2.describe_flow_logs()
for flow_log in response['FlowLogs']:
    print(flow_log)

By following these steps, you can use Python to enable network firewall logging for AWS EC2 instances.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Network Firewall Logging Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation