opened
FireballDWF
username_0
Optional creation of VPC Flow Logs. If enabled, requires additional stack included in this pull request to be executed first
Vpcflowlogs
issue
created
santiagocardenas
username_1
Hi @username_0,
Can you please sync up your fork to the repo? I see some changes that we have eliminated from the repo following the last merge.

Thanks,
Santiago
comment
created
santiagocardenas
username_1
Also, I don't see how the VPC flow logs are integral to the VPC itself. They are often used as a diagnotic tool. I recommend separating that logic into its own VPC flow log template that uses the VPC outputs as parameters to run itself.
comment
created
FireballDWF
username_0
I agree the VPC flow logs are not integral to the VPC itself, and I'm willing to make the change you recommend.  However, what I did submit has a parameter to enable/disable the flow logs.  And as it's a Security Best Practice to enable them, we should consider making it as easy as possible for people to do so.  How about this to resolve which direction to take: You go to whomever you trust as an authority on AWS Best Practices to get their opinion, consider it, then let me know which way you want me to go with the change, and I'll comply.
comment
created
0rc
username_2
@username_0 why do you think it's better to have iam role for flow logs in a separate template?
Why not put that to original template with conditional statement?
comment
created
FireballDWF
username_0
Reuse same role across multiple VPCs, where multiple VPCs can be build in
parallel
comment
created
0rc
username_2
Then I would agree with @username_1 - it makes sense to keep flow logs in separate template
comment
created
santiagocardenas
username_1
Closing since it should be added separate template.
comment