1. Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
2. Navigate to VPC Dashboard: Click on the “Services” dropdown menu at the top left corner, then select “VPC” under the Networking & Content Delivery section.
3. Select the VPC: In the VPC Dashboard, locate and click on the VPC that contains the subnet where you want to enable Flow Logs.
4. Select the Subnet: In the left-hand menu, click on “Subnets” to view all the subnets within the selected VPC. Locate and select the specific subnet where you want to enable Flow Logs by clicking on the checkbox next to the subnet.
5. Enable Flow Logs: With the subnet selected, click on the “Actions” dropdown menu above the subnets list, and then select “Create flow log” from the options.
6. Configure Flow Logs: In the “Create flow log” wizard, you will need to configure the following:
   • Filter: Choose the type of traffic you want to capture in the flow logs (e.g., All traffic, Accepted traffic, Rejected traffic).
   • Destination: Select the destination where you want to store the flow logs (e.g., CloudWatch Logs, S3).
   • IAM Role: If you haven’t already set up the necessary IAM role for Flow Logs, you may need to create a new IAM role or choose an existing one that grants the required permissions.
7. Review and Create: Review the configuration settings to ensure they are correct, then click on the “Create flow log” button to enable Flow Logs on the selected subnet.
8. Verify: Once the Flow Logs are enabled, you can verify that they are working correctly by checking the designated destination (e.g., CloudWatch Logs or S3) for log data.

​

1. Enable VPC Flow Logs on the Subnet: Run the following AWS CLI command to enable VPC Flow Logs on the desired subnet:
   aws ec2 create-flow-logs --resource-type Subnet --resource-id <subnet-id> --traffic-type ALL --log-group-name <log-group-name> --deliver-logs-permission-arn <IAM-role-arn>
   
   Replace <subnet-id> with the ID of the subnet for which you want to enable Flow Logs, <log-group-name> with the name of the CloudWatch Logs group where the logs will be stored, and <IAM-role-arn> with the ARN of the IAM role that will be used to deliver the logs.
2. Configure Flow Log Settings: You can further configure the Flow Log settings by specifying the desired parameters like --max-aggregation-interval, --log-destination-type, --log-destination, etc., based on your requirements.
3. Verify Flow Logs: To verify that Flow Logs have been enabled successfully, you can run the following command:
   aws ec2 describe-flow-logs --query 'FlowLogs[*].[FlowLogId, DeliverLogsPermissionArn, LogGroupName, ResourceId]' --output table
   
   This command will display the details of the enabled Flow Logs, including the FlowLogId, DeliverLogsPermissionArn, LogGroupName, and ResourceId.

1. Install the Boto3 library:

pip install boto3

2. Configure AWS credentials: Ensure that you have configured your AWS credentials either by setting environment variables or using the AWS CLI aws configure command.
3. Write a Python script to enable Flow Logs on the desired subnet:

import boto3

def enable_flow_logs(subnet_id):
    ec2_client = boto3.client('ec2')
    
    response = ec2_client.create_flow_logs(
        DeliverLogsPermissionArn='arn:aws:iam::123456789012:role/flow-logs-role',  # Replace with your IAM role ARN
        ResourceIds=[subnet_id],
        ResourceType='Subnet',
        TrafficType='ALL',
        LogDestinationType='cloud-watch-logs',
        LogDestination='arn:aws:logs:us-east-1:123456789012:log-group:flow-logs-group'
    )
    
    print('Flow Logs enabled for subnet:', subnet_id)

# Replace 'subnet-1234567890abcdef0' with the actual subnet ID
enable_flow_logs('subnet-1234567890abcdef0')

4. Replace the placeholders in the script with your actual values:

• DeliverLogsPermissionArn: Replace with the ARN of an IAM role that has permission to deliver logs to CloudWatch Logs.
• LogDestination: Replace with the ARN of the CloudWatch Logs log group where you want to store the Flow Logs.
• ResourceIds: Replace with the subnet ID where you want to enable Flow Logs.

5. Run the Python script: Execute the Python script to enable Flow Logs on the specified subnet. Make sure to have the necessary permissions to create Flow Logs and access the specified resources.

# IAM role that VPC Flow Logs will assume to publish to CloudWatch Logs
resource "aws_iam_role" "vpc_flow_logs_role" {
  name = "VPCFlowLogsRole"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "vpc-flow-logs.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

# IAM policy granting permissions to write to the CloudWatch Logs log group
resource "aws_iam_role_policy" "vpc_flow_logs_policy" {
  name = "VPCFlowLogsPolicy"
  role = aws_iam_role.vpc_flow_logs_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:DescribeLogGroups",
          "logs:DescribeLogStreams",
          "logs:PutLogEvents",
          "logs:PutRetentionPolicy"
        ]
        Resource = "*"
      }
    ]
  })
}

# Existing subnet where flow logs must be enabled
resource "aws_subnet" "this" {
  vpc_id                  = aws_vpc.MY_VPC.id            # replace aws_vpc.MY_VPC.id with your VPC reference
  cidr_block              = "CIDR_BLOCK_FOR_SUBNET"      # replace with your subnet CIDR, e.g., "10.0.1.0/24"
  availability_zone       = "AVAILABILITY_ZONE"          # replace with your AZ, e.g., "us-east-1a"
  map_public_ip_on_launch = false
}

# CloudWatch Logs log group to receive the flow logs
resource "aws_cloudwatch_log_group" "vpc_flow_logs" {
  name              = "VPCFlowLogs-LOG_GROUP_NAME" # replace LOG_GROUP_NAME with your desired log group suffix
  retention_in_days = 90                           # adjust retention as needed
}

# Flow log for the subnet, delivering ALL traffic logs to CloudWatch Logs
resource "aws_flow_log" "subnet_flow_logs" {
  iam_role_arn    = aws_iam_role.vpc_flow_logs_role.arn
  log_destination = aws_cloudwatch_log_group.vpc_flow_logs.arn
  traffic_type    = "ALL"

  vpc_id        = null
  subnet_id     = aws_subnet.this.id
  transit_gateway_id = null

  log_destination_type = "cloud-watch-logs"

  tags = {
    Name = "SUBNET_FLOW_LOGS_FOR_${aws_subnet.this.id}"
  }
}

• + creation of aws_iam_role.vpc_flow_logs_role
• + creation of aws_iam_role_policy.vpc_flow_logs_policy
• + creation of aws_cloudwatch_log_group.vpc_flow_logs
• + creation of aws_flow_log.subnet_flow_logs with no ~ or - changes required on existing subnets beyond depending on these new resources.