Repository: cloud-custodian/cloud-custodian

Issue:
aws.vpc | action: set-flow-log doesn't allow the user to set a custom MaxAggregationInterval 
**Is your feature request related to a problem? Please describe.**
 Our use case is to set vpc flow logs aggregation to something less than 600 seconds. https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ec2.html#EC2.Client.create_flow_logs
As of now it's not customizable and takes a default value of 600 seconds.

**Describe the solution you'd like**
Create a new param in `action: set-flow-log` called `MaxAggregationInterval` which would allow policy authors to use it. The default value would be: 600 seconds 




Discussion:

Resolving patch:
diff --git a/c7n/resources/vpc.py b/c7n/resources/vpc.py
--- a/c7n/resources/vpc.py
+++ b/c7n/resources/vpc.py
@@ -1997,6 +1997,7 @@ class CreateFlowLogs(BaseAction):
             'LogGroupName': {'type': 'string'},
             'LogDestination': {'type': 'string'},
             'LogFormat': {'type': 'string'},
+            'MaxAggregationInterval': {'type': 'integer'},
             'LogDestinationType': {'enum': ['s3', 'cloud-watch-logs']},
             'TrafficType': {
                 'type': 'string',
@@ -2081,6 +2082,7 @@ def process(self, resources):
 
         params['ResourceType'] = self.RESOURCE_ALIAS[model.arn_type]
         params['TrafficType'] = self.data.get('TrafficType', 'ALL').upper()
+        params['MaxAggregationInterval'] = self.data.get('MaxAggregationInterval', 600)
 
         try:
             results = client.create_flow_logs(**params)


Test patch:
diff --git a/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.CreateFlowLogs_1.json b/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.CreateFlowLogs_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.CreateFlowLogs_1.json
@@ -0,0 +1,11 @@
+{
+  "status_code": 200,
+  "data": {
+    "ClientToken": "KoA5EZDuW9WCgXqA/Fm0dKXCqAKZGrH2+vUIPhKlfOY=",
+    "FlowLogIds": [
+      "fl-0bb8640b899a159d7"
+    ],
+    "Unsuccessful": [],
+    "ResponseMetadata": {}
+  }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.DescribeFlowLogs_1.json b/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.DescribeFlowLogs_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.DescribeFlowLogs_1.json
@@ -0,0 +1,32 @@
+{
+  "status_code": 200,
+  "data": {
+    "FlowLogs": [
+      {
+        "CreationTime": {
+          "__class__": "datetime",
+          "year": 2020,
+          "month": 3,
+          "day": 16,
+          "hour": 17,
+          "minute": 22,
+          "second": 5,
+          "microsecond": 704000
+        },
+        "DeliverLogsPermissionArn": "arn:aws:iam::644160558196:role/CloudCustodianRole",
+        "DeliverLogsStatus": "SUCCESS",
+        "FlowLogId": "fl-0635fc3a6aa64dd72",
+        "FlowLogStatus": "ACTIVE",
+        "LogGroupName": "/custodian/vpc_logs/",
+        "ResourceId": "vpc-03005fb9b8740263d",
+        "TrafficType": "ALL",
+        "LogDestinationType": "cloud-watch-logs",
+        "LogDestination": "arn:aws:logs:us-east-1:644160558196:log-group:/custodian/vpc_logs/",
+        "LogFormat": "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}",
+        "Tags": [],
+        "MaxAggregationInterval": 600
+      }
+    ],
+    "ResponseMetadata": {}
+  }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.DescribeFlowLogs_2.json b/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.DescribeFlowLogs_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.DescribeFlowLogs_2.json
@@ -0,0 +1,30 @@
+{
+  "status_code": 200,
+  "data": {
+    "FlowLogs": [
+      {
+        "CreationTime": {
+          "__class__": "datetime",
+          "year": 2020,
+          "month": 3,
+          "day": 16,
+          "hour": 17,
+          "minute": 23,
+          "second": 17,
+          "microsecond": 970000
+        },
+        "DeliverLogsStatus": "SUCCESS",
+        "FlowLogId": "fl-0bb8640b899a159d7",
+        "FlowLogStatus": "ACTIVE",
+        "ResourceId": "vpc-d2d616b5",
+        "TrafficType": "ALL",
+        "LogDestinationType": "s3",
+        "LogDestination": "arn:aws:s3:::c7n-vpc-flow-logs/test.log.gz",
+        "LogFormat": "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}",
+        "Tags": [],
+        "MaxAggregationInterval": 60
+      }
+    ],
+    "ResponseMetadata": {}
+  }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.DescribeVpcs_1.json b/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.DescribeVpcs_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_vpc_set_flow_logs_maxaggrinterval/ec2.DescribeVpcs_1.json
@@ -0,0 +1,32 @@
+{
+  "status_code": 200,
+  "data": {
+    "Vpcs": [
+      {
+        "CidrBlock": "172.31.0.0/16",
+        "DhcpOptionsId": "dopt-24ff1940",
+        "State": "available",
+        "VpcId": "vpc-d2d616b5",
+        "OwnerId": "644160558196",
+        "InstanceTenancy": "default",
+        "CidrBlockAssociationSet": [
+          {
+            "AssociationId": "vpc-cidr-assoc-33669f5a",
+            "CidrBlock": "172.31.0.0/16",
+            "CidrBlockState": {
+              "State": "associated"
+            }
+          }
+        ],
+        "IsDefault": true,
+        "Tags": [
+          {
+            "Key": "Name",
+            "Value": "FlowLogTest"
+          }
+        ]
+      }
+    ],
+    "ResponseMetadata": {}
+  }
+}
\ No newline at end of file
diff --git a/tests/test_vpc.py b/tests/test_vpc.py
--- a/tests/test_vpc.py
+++ b/tests/test_vpc.py
@@ -2689,3 +2689,34 @@ def test_vpc_delete_flow_logs(self):
             "FlowLogs"
         ]
         self.assertFalse(logs)
+
+    def test_vpc_set_flow_logs_maxaggrinterval(self):
+        session_factory = self.replay_flight_data("test_vpc_set_flow_logs_maxaggrinterval")
+        p = self.load_policy(
+            {
+                "name": "c7n-vpc-flow-logs-maxinterval",
+                "resource": "vpc",
+                "filters": [
+                    {'type': 'flow-logs', 'enabled': False}
+                ],
+                "actions": [
+                    {
+                        "type": "set-flow-log",
+                        "LogDestinationType": "s3",
+                        "LogDestination": "arn:aws:s3:::c7n-vpc-flow-logs/test.log.gz",
+                        "MaxAggregationInterval": 60,
+                    }
+                ],
+            },
+            session_factory=session_factory,
+        )
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+        self.assertEqual(resources[0]["VpcId"], "vpc-d2d616b5")
+        client = session_factory(region="us-east-1").client("ec2")
+        logs = client.describe_flow_logs(
+            Filters=[{"Name": "resource-id", "Values": [resources[0]["VpcId"]]}]
+        )[
+            "FlowLogs"
+        ]
+        self.assertEqual(logs[0]["MaxAggregationInterval"], 60)