Flow Logs on VPC Should Be Enabled

Using Console

To remediate the misconfiguration of not having Flow Logs enabled on VPC for AWS Security Groups, follow these steps using the AWS Management Console:

Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
Navigate to VPC Dashboard: Click on the “Services” dropdown at the top left corner, select “VPC” under the Networking & Content Delivery section.
Select Your VPC: In the VPC Dashboard, locate and select the VPC for which you want to enable Flow Logs.
Enable Flow Logs: Under the “VPC Dashboard”, on the left-hand side, click on “Flow Logs”.
Create Flow Log: Click on the “Create Flow Log” button.
Configure Flow Log:
- Log Destination: Choose the destination where you want to store the flow logs. You can select either Amazon CloudWatch Logs or Amazon S3.
- IAM Role: Create a new IAM role or choose an existing IAM role that grants necessary permissions for Flow Logs to publish logs.
- Filter: Select the filter that includes the traffic you want to capture in the flow logs. For Security Groups, you can choose “All” to capture all traffic or create a custom filter based on your requirements.
- Role Name: Provide a name for the Flow Log.
Enable Flow Log: Click on “Create Flow Log” to enable Flow Logs for the selected VPC.
Verify Flow Log: Once the Flow Log is created, verify that it is active and capturing the required traffic.

By following these steps, you will have successfully enabled Flow Logs on the VPC for AWS Security Groups, helping you monitor and analyze the network traffic for enhanced security and compliance.

Using CLI

To remediate the misconfiguration of Flow Logs not being enabled on VPC for AWS Security Groups using AWS CLI, follow these steps:

Identify the VPC ID: First, you need to identify the VPC ID for which you want to enable Flow Logs. You can do this by running the following AWS CLI command:
aws ec2 describe-vpcs
Enable Flow Logs: Once you have the VPC ID, you can enable Flow Logs for the VPC by running the following AWS CLI command:
aws ec2 create-flow-logs --resource-type VPC --resource-id <VPC_ID> --traffic-type ALL --log-group-name <LOG_GROUP_NAME> --deliver-logs-permission-arn <ARN_OF_THE_LOGS_DELIVERY_ROLE>
- Replace <VPC_ID> with the actual VPC ID you identified in step 1.
- Replace <LOG_GROUP_NAME> with the name of the CloudWatch Logs group where you want to store the Flow Logs.
- Replace <ARN_OF_THE_LOGS_DELIVERY_ROLE> with the ARN of the IAM role that has permissions to deliver logs to CloudWatch Logs.
Verify Flow Logs Configuration: To verify that the Flow Logs have been successfully enabled for the VPC, you can run the following AWS CLI command:
aws ec2 describe-flow-logs --filter Name=resource-id,Values=<VPC_ID>
- Replace <VPC_ID> with the actual VPC ID.

By following these steps, you can successfully remediate the misconfiguration of Flow Logs not being enabled on VPC for AWS Security Groups using AWS CLI.

Using Python

To remediate the misconfiguration of Flow Logs not being enabled on VPC for AWS Security Groups using Python, you can follow these steps:

Import the necessary Python libraries:

import boto3

Initialize the AWS EC2 client:

ec2_client = boto3.client('ec2')

Get a list of all VPCs in the AWS account:

vpcs = ec2_client.describe_vpcs()

For each VPC, check if Flow Logs are enabled. If not, enable Flow Logs:

for vpc in vpcs['Vpcs']:
    vpc_id = vpc['VpcId']
    
    # Check if Flow Logs are enabled for the VPC
    flow_logs = ec2_client.describe_flow_logs(
        Filters=[
            {
                'Name': 'resource-id',
                'Values': [vpc_id]
            }
        ]
    )
    
    if not flow_logs['FlowLogs']:
        # Enable Flow Logs for the VPC
        response = ec2_client.create_flow_logs(
            ResourceIds=[vpc_id],
            ResourceType='VPC',
            TrafficType='ALL',
            LogGroupName='FlowLogsGroup',
            DeliverLogsPermissionArn='arn:aws:iam::123456789012:role/FlowLogsRole'
        )
        
        print(f"Flow Logs enabled for VPC: {vpc_id}")

Replace 'arn:aws:iam::123456789012:role/FlowLogsRole' with the appropriate IAM role ARN that has permissions to publish logs to CloudWatch Logs.
Run the Python script to enable Flow Logs for VPCs without them.

By following these steps and running the Python script, you can remediate the misconfiguration of Flow Logs not being enabled on VPC for AWS Security Groups.

Using Terraform

# VPC with Flow Logs enabled to CloudWatch Logs
resource "aws_vpc" "MAIN_VPC" {
  cidr_block = "VPC_CIDR_BLOCK" # e.g., "10.0.0.0/16"
}

# Pre-existing CloudWatch Log Group for VPC Flow Logs
resource "aws_cloudwatch_log_group" "VPC_FLOW_LOG_GROUP" {
  name = "VPC_FLOW_LOG_GROUP_NAME" # replace with your log group name
}

# IAM role that VPC Flow Logs will assume to publish to CloudWatch Logs
resource "aws_iam_role" "VPC_FLOW_LOG_ROLE" {
  name = "VPC_FLOW_LOG_ROLE_NAME"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Service = "vpc-flow-logs.amazonaws.com"
      }
      Action = "sts:AssumeRole"
    }]
  })
}

# IAM policy allowing writes to the CloudWatch Log Group
resource "aws_iam_role_policy" "VPC_FLOW_LOG_ROLE_POLICY" {
  name = "VPC_FLOW_LOG_ROLE_POLICY_NAME"
  role = aws_iam_role.VPC_FLOW_LOG_ROLE.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams"
      ]
      Resource = "${aws_cloudwatch_log_group.VPC_FLOW_LOG_GROUP.arn}:*"
    }]
  })
}

# VPC Flow Log to CloudWatch Logs (equivalent to aws ec2 create-flow-logs ... --log-destination-type cloud-watch-logs)
resource "aws_flow_log" "VPC_FLOW_LOG_CW" {
  log_destination_type = "cloud-watch-logs"
  log_group_name       = aws_cloudwatch_log_group.VPC_FLOW_LOG_GROUP.name
  iam_role_arn         = aws_iam_role.VPC_FLOW_LOG_ROLE.arn

  traffic_type = "ALL"
  vpc_id       = aws_vpc.MAIN_VPC.id
}

# OPTIONAL: VPC Flow Log to S3 (equivalent to aws ec2 create-flow-logs ... --log-destination-type s3)
resource "aws_s3_bucket" "VPC_FLOW_LOG_BUCKET" {
  bucket = "VPC_FLOW_LOG_BUCKET_NAME" # replace with your bucket name
}

# Bucket policy granting VPC Flow Logs service permission to write
data "aws_caller_identity" "current" {}

resource "aws_s3_bucket_policy" "VPC_FLOW_LOG_BUCKET_POLICY" {
  bucket = aws_s3_bucket.VPC_FLOW_LOG_BUCKET.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AWSLogDeliveryWrite"
        Effect = "Allow"
        Principal = {
          Service = "delivery.logs.amazonaws.com"
        }
        Action = [
          "s3:PutObject",
          "s3:GetBucketAcl"
        ]
        Resource = [
          "arn:aws:s3:::${aws_s3_bucket.VPC_FLOW_LOG_BUCKET.bucket}",
          "arn:aws:s3:::${aws_s3_bucket.VPC_FLOW_LOG_BUCKET.bucket}/VPC_FLOW_LOG_PREFIX/*" # replace VPC_FLOW_LOG_PREFIX or remove suffix
        ]
        Condition = {
          StringEquals = {
            "s3:x-amz-acl" = "bucket-owner-full-control"
          }
        }
      }
    ]
  })
}

resource "aws_flow_log" "VPC_FLOW_LOG_S3" {
  log_destination_type = "s3"
  log_destination      = "arn:aws:s3:::${aws_s3_bucket.VPC_FLOW_LOG_BUCKET.bucket}/VPC_FLOW_LOG_PREFIX" # replace prefix or remove

  traffic_type = "ALL"
  vpc_id       = aws_vpc.MAIN_VPC.id

  depends_on = [aws_s3_bucket_policy.VPC_FLOW_LOG_BUCKET_POLICY]
}

VPC Flow Logs cannot be enabled on Security Groups themselves; logging is configured on the VPC (or subnet/ENI), as shown above.This change does not force replacement of the VPC; terraform plan should show new aws_flow_log (and supporting IAM/log group/S3 resources if added) being created and no destructive changes to existing VPCs.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Flow Logs on VPC Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: