Vpc network route logging remediation

gcloud compute networks subnets list \
  --format="table(name,region,network,enableFlowLogs)"

gcloud compute networks subnets update SUBNET_NAME \
  --region=REGION \
  --enable-flow-logs

gcloud compute networks subnets update SUBNET_NAME \
  --region=REGION \
  --enable-flow-logs \
  --logging-aggregation-interval=INTERVAL \
  --logging-flow-sampling=SAMPLING_RATIO \
  --logging-metadata=INCLUDE_ALL_METADATA|EXCLUDE_ALL_METADATA|CUSTOM_METADATA

# Example: 5-minute aggregation, 0.5% sampling, include all metadata
gcloud compute networks subnets update my-subnet \
  --region=us-central1 \
  --enable-flow-logs \
  --logging-aggregation-interval=interval-5-min \
  --logging-flow-sampling=0.005 \
  --logging-metadata=INCLUDE_ALL_METADATA

gcloud compute networks subnets describe SUBNET_NAME \
  --region=REGION \
  --format="flattened(enableFlowLogs,logConfig)"

NETWORK_NAME="YOUR_VPC_NETWORK"

for REGION in $(gcloud compute networks subnets list \
                  --filter="network:${NETWORK_NAME}" \
                  --format="value(region)" | sort -u); do
  for SUBNET in $(gcloud compute networks subnets list \
                    --filter="network:${NETWORK_NAME} AND region:${REGION}" \
                    --format="value(name)"); do
    gcloud compute networks subnets update "$SUBNET" \
      --region="$REGION" \
      --enable-flow-logs
  done
done

pip install google-api-python-client google-auth google-auth-httplib2

gcloud auth application-default login

from googleapiclient import discovery
from google.auth import default

PROJECT_ID = "YOUR_PROJECT_ID"
NETWORK_NAME = "YOUR_VPC_NETWORK_NAME"  # e.g., "default"

def main():
    credentials, _ = default()
    compute = discovery.build("compute", "v1", credentials=credentials)

    # 1. List all subnetworks in the project
    request = compute.subnetworks().aggregatedList(project=PROJECT_ID)
    all_subnetworks = []

    while request is not None:
        response = request.execute()
        for region, region_data in response.get("items", {}).items():
            for subnetwork in region_data.get("subnetworks", []):
                all_subnetworks.append(subnetwork)
        request = compute.subnetworks().aggregatedList_next(
            previous_request=request, previous_response=response
        )

    # 2. Filter subnetworks that belong to the specified VPC network
    target_subnetworks = [
        s for s in all_subnetworks
        if s.get("network", "").endswith("/networks/" + NETWORK_NAME)
    ]

    # 3. Enable flow logs on each subnetwork (if disabled)
    for s in target_subnetworks:
        if s.get("enableFlowLogs"):
            print(f"Flow logs already enabled for: {s['name']} ({s['region']})")
            continue

        subnetwork_name = s["name"]
        subnetwork_region = s["region"].split("/")[-1]

        # Subnetwork patch body: keep existing fields, just set enableFlowLogs and logConfig
        body = {
            "enableFlowLogs": True,
            "logConfig": {
                "aggregationInterval": "INTERVAL_5_MIN",      # e.g. 5-minute aggregation
                "flowSampling": 0.5,                          # 50% sampling
                "metadata": "INCLUDE_ALL_METADATA",           # or "EXCLUDE_ALL_METADATA"/"CUSTOM_METADATA"
            }
        }

        print(f"Enabling flow logs for: {subnetwork_name} ({subnetwork_region})")
        request = compute.subnetworks().patch(
            project=PROJECT_ID,
            region=subnetwork_region,
            subnetwork=subnetwork_name,
            body=body,
        )
        response = request.execute()
        print(f"Operation started: {response.get('name')}")

if __name__ == "__main__":
    main()

# There is currently no Terraform argument on any google_* resource
# that enables or configures GCP "VPC Network Route Logging".
#
# Route logging is controlled only by GCP itself (Console / gcloud),
# not exposed via the google provider yet, so it cannot be remediated
# directly in Terraform.

# You must enable it outside Terraform, for example:
# - In the Console: VPC Network → Routes → Route logging settings,
#   then enable route logging for the desired network(s); or
# - With gcloud: use the documented `gcloud compute` commands
#   for route logging once they are available in your SDK.

# After doing so, `terraform plan` will show no changes related to
# route logging, because the provider cannot manage that setting.