Control: 4.13 Ensure VCN flow logging is enabled for all subnets

Description

VCN flow logs record details about traffic that has been accepted or rejected based on the security list rule.

Enabling VCN flow logs enables you to monitor traffic flowing within your virtual network and can be used to detect anomalous traffic.

Remediation

From Console

First, if a log group for holding these logs has not already been created, create a log group by the following steps:

1. Go to the Log Groups page.
2. Click the Create Log Groups button in the middle of the screen.
3. Select the relevant compartment to place these logs.
4. Type a name for the log group in the Name box.
5. Add an optional description in the Description box.
6. Click the Create button in the lower left hand corner.

Second, enable VCN flow logging for your subnet(s) by the following steps:

1. Go to the Logs page.
2. Click the Enable Service Log button in the middle of the screen.
3. Select the relevant resource compartment.
4. Select Virtual Cloud Networks (subnets) from the Service drop down menu.
5. Select the relevant resource from the resource drop down menu.
6. Select Flow Logs (all records) from the Log Category drop down menu.
7. Type a name for your flow logs in the Log Name drop down menu.
8. Click the Enable Log button in the lower left hand corner.

From CLI

1. Create a log group:

oci logging log-group create --compartment-id $C \ --display-name "<DisplayName>" \--description "<Description>"

The output of the command gives you a work request id. You can query the work request to see the status of the job by issuing the following command:

oci logging work-request get --work-request-id <work-request-id>

Look for the status filed to be SUCCEEDED.

2. Get the Log group ID, needed for creating the Log:

oci logging log-group list --compartment-id $C \--query 'data[?contains("display-name", `'"<DisplayName>"'`)].id|join(`\n`, @)' \--raw-output

3. Create a JSON file called config.json with the following content:

{
  "compartment-id":"ocid1.compartment.oc1.......",
  "source": {
    "resource": "ocid1.subnet.oc1.iad.......",
    "service": "flowlogs",
    "source-type": "OCISERVICE",
    "category": "all"
  }
}

The compartment-id is the Compartment OCID of where the subnet resource is present. The resource value is the OCID of subnet for which flowlogs is enabled.

4. Create the Service Log:

oci logging log create --log-group-id <value from step 3.> \ --display-name "<DisplayName>" \ --log-type SERVICE --is-enabled TRUE \ --configuration file://config.json

The output of the command gives you a work request id. You can query the work request to see that status of the job by issuing the following command:

oci logging work-request get --work-request-id <work-request-id>

Look for the status filed to be SUCCEEDED.