Control: 2.9 Ensure VPC flow logging is enabled in all VPCs

Description

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Rejects" for VPCs.

VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.

Remediation

Perform the following to determine if VPC Flow logs is enabled:

Via the Management Console:

Sign into the management console.
Select Services then VPC.
In the left navigation pane, select Your VPCs.
Select a VPC.
In the right pane, select the Flow Logs tab.
If no Flow Log exists, click Create Flow Log.
For Filter, select Reject.
Enter in a Role and Destination Log Group.
Click Create Log Flow.
Click on CloudWatch Logs Group.

Note: Setting the filter to "Reject" will dramatically reduce the logging data accumulation for this recommendation and provide sufficient information for the purposes of breach detection, research and remediation. However, during periods of least privilege security group engineering, setting this the filter to "All" can be very helpful in discovering existing traffic flows required for proper operation of an already running environment.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v120_2_9

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v120_2_9 --share

SQL

This control uses a named query:

with vpcs as (
  select
    arn,
    account_id,
    region,
    owner_id,
    vpc_id,
    tags,
    _ctx
  from
    aws_vpc
  order by
    vpc_id
),
flowlogs as (
  select
    resource_id,
    account_id,
    region
  from
    aws_vpc_flow_log
  order by
    resource_id
)
select
  v.arn as resource,
  case
    when v.account_id <> v.owner_id then 'skip'
    when f.resource_id is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when v.account_id <> v.owner_id then v.vpc_id || ' is a shared VPC.'
    when f.resource_id is not null then v.vpc_id || ' flow logging enabled.'
    else v.vpc_id || ' flow logging disabled.'
  end as reason
  
  , v.region, v.account_id
from
  vpcs as v
  left join flowlogs as f on v.vpc_id = f.resource_id;

Control: 2.9 Ensure VPC flow logging is enabled in all VPCs

Description

Remediation

Via the Management Console:

Usage

SQL

Tags