Flow Logs on VPC Should Be Enabled
More Info:
VPC flow logs record all traffic flowing in to and out of a VPC. These logs are critical for auditing and review after security incidents.Risk Level
LowAddress
SecurityCompliance Standards
HIPAA, PCIDSS, GDPR, SOC2, CISAWS, CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of not having Flow Logs enabled on VPC for AWS Security Groups, follow these steps using the AWS Management Console:
- Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
- Navigate to VPC Dashboard: Click on the “Services” dropdown at the top left corner, select “VPC” under the Networking & Content Delivery section.
- Select Your VPC: In the VPC Dashboard, locate and select the VPC for which you want to enable Flow Logs.
- Enable Flow Logs: Under the “VPC Dashboard”, on the left-hand side, click on “Flow Logs”.
- Create Flow Log: Click on the “Create Flow Log” button.
-
Configure Flow Log:
- Log Destination: Choose the destination where you want to store the flow logs. You can select either Amazon CloudWatch Logs or Amazon S3.
- IAM Role: Create a new IAM role or choose an existing IAM role that grants necessary permissions for Flow Logs to publish logs.
- Filter: Select the filter that includes the traffic you want to capture in the flow logs. For Security Groups, you can choose “All” to capture all traffic or create a custom filter based on your requirements.
- Role Name: Provide a name for the Flow Log.
- Enable Flow Log: Click on “Create Flow Log” to enable Flow Logs for the selected VPC.
- Verify Flow Log: Once the Flow Log is created, verify that it is active and capturing the required traffic.
Using CLI
Using CLI
To remediate the misconfiguration of Flow Logs not being enabled on VPC for AWS Security Groups using AWS CLI, follow these steps:
-
Identify the VPC ID: First, you need to identify the VPC ID for which you want to enable Flow Logs. You can do this by running the following AWS CLI command:
-
Enable Flow Logs: Once you have the VPC ID, you can enable Flow Logs for the VPC by running the following AWS CLI command:
- Replace
<VPC_ID>with the actual VPC ID you identified in step 1. - Replace
<LOG_GROUP_NAME>with the name of the CloudWatch Logs group where you want to store the Flow Logs. - Replace
<ARN_OF_THE_LOGS_DELIVERY_ROLE>with the ARN of the IAM role that has permissions to deliver logs to CloudWatch Logs.
- Replace
-
Verify Flow Logs Configuration: To verify that the Flow Logs have been successfully enabled for the VPC, you can run the following AWS CLI command:
- Replace
<VPC_ID>with the actual VPC ID.
- Replace
Using Python
Using Python
To remediate the misconfiguration of Flow Logs not being enabled on VPC for AWS Security Groups using Python, you can follow these steps:
- Import the necessary Python libraries:
- Initialize the AWS EC2 client:
- Get a list of all VPCs in the AWS account:
- For each VPC, check if Flow Logs are enabled. If not, enable Flow Logs:
-
Replace
'arn:aws:iam::123456789012:role/FlowLogsRole'with the appropriate IAM role ARN that has permissions to publish logs to CloudWatch Logs. - Run the Python script to enable Flow Logs for VPCs without them.