Check provider logo

VPC flow logs are enabled

vpc_flow_logs_enabled

Severitymedium
Servicevpc
by Prowler
loggingforensics-ready

AWS VPCs have Flow Logs configured to capture IP traffic for their network interfaces and deliver records to a logging destination.

VPCs lacking an active flow log configuration are highlighted.

Risk

Without flow logs, network activity is opaque, hindering detection and investigation of malicious traffic. Attackers can probe, exfiltrate, or move laterally unnoticed, impacting confidentiality and integrity; outages and misconfigurations are harder to diagnose, reducing availability.

Run this check with Prowler CLI

prowler aws --checks vpc_flow_logs_enabled

Run in Prowler Cloud

Recommendation

Enable VPC Flow Logs for all VPCs to provide baseline telemetry. Prefer capturing at least REJECT and, for sensitive networks, ALL. Send logs to a centralized, access-controlled destination with retention. Apply least privilege to writers/readers and integrate with monitoring for defense in depth.

Remediation

CLI

aws ec2 create-flow-logs --resource-type VPC --resource-ids <VPC_ID> --traffic-type ALL --log-destination-type s3 --log-destination arn:aws:s3:::<S3_BUCKET_NAME>

Native IaC
Terraform
Other
  1. In the AWS Console, go to VPC > Your VPCs
  2. Select the target VPC
  3. Open the Flow logs tab and click Create flow log
  4. Set Traffic type to All
  5. Set Destination to S3 and enter Bucket ARN: arn:aws:s3:::<example_resource_name>
  6. Click Create flow log

Source Code

Resource Type

AwsEc2Vpc

References