Project: KICS (Provisioning / Security & Compliance)
File: f83121ea-03da-434f-9277-9cd247ab3047.md

title: VPC FlowLogs Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f83121ea-03da-434f-9277-9cd247ab3047 Query name: VPC FlowLogs Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Every VPC resource should have an associated Flow Log<br> ```tf title="Positive test num. 1 - tf file" hl_lines="5" resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" } resource "awsflowlog" "example" { iamrolearn = awsiamrole.example.arn logdestination = awscloudwatchloggroup.example.arn traffic_type = "ALL" } resource "awsflowlog" "example1" { iamrolearn = awsiamrole.example.arn logdestination = awscloudwatchloggroup.main.arn traffic_type = "ALL" vpcid = awsvpc.main.id } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" } resource "awsflowlog" "example" { iamrolearn = awsiamrole.example.arn logdestination = awscloudwatchloggroup.example.arn traffic_type = "ALL" vpcid = awsvpc.example.id } resource "awsflowlog" "example2" { iamrolearn = awsiamrole.example.arn logdestination = awscloudwatchloggroup.example.arn traffic_type = "ALL" vpcid = awsvpc.example2.id } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="14" module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true enableflowlog = false tags = { Terraform = "true" Environment = "dev" } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="1" module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true tags = { Terraform = "true" Environment = "dev" } } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" } resource "awsflowlog" "example" { iamrolearn = awsiamrole.example.arn logdestination = awscloudwatchloggroup.example.arn traffic_type = "ALL" vpcid = awsvpc.example.id } resource "awsflowlog" "example2" { iamrolearn = awsiamrole.example.arn logdestination = awscloudwatchloggroup.example.arn traffic_type = "ALL" vpcid = awsvpc.main.id } ``` ```tf title="Negative test num. 2 - tf file" module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "3.7.0" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enablenatgateway = true enablevpngateway = true enableflowlog = true tags = { Terraform = "true" Environment = "dev" } } ```