All checks
Medium
VPC flow logging should be enabled in all VPCs
Verifies that each VPC has a flow log, which records the traffic crossing it for detecting anomalies and investigating incidents. Only a flow log on the VPC itself counts, not one on a subnet or network interface or one collected through Security Lake; its traffic filter and whether delivery is succeeding are not checked.
- service
- EC2
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
VPC → Your VPCs → the VPC → Flow logs → Create flow log
With the AWS CLI
aws ec2 create-flow-logs --resource-ids <vpc-id> --resource-type VPC --traffic-type ALL --log-destination-type s3 --log-destination <s3-bucket-arn> --region <region>With Terraform
resource "aws_flow_log" "this" {
vpc_id = var.vpc_id
traffic_type = "ALL"
log_destination_type = "s3"
log_destination = var.flow_log_bucket_arn
}See which of your accounts this check is failing on.
Book a demo