Enable Flow Logs for your VPC and collect all traffic in and out of your VPC network
Tags: aws, azure, cybersecurity, devops
Published: 2023-04-06 12:53:23

**VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC.**

**Flow logs can help you with a number of tasks, such as:**

- Diagnosing overly restrictive security group rules
- Monitoring the traffic that is reaching your instance
- Determining the direction of the traffic to and from the network interfaces

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nqa6x2uky6g8qm1f75kg.png)

## Create your VPC , Subnet , InternetGateway & Routes table with Subnets Associations.

**Create a VPC in Mumbai region.**
**VPC name :- VPC-Mumbai**
**Ipv4 CIDR :- 11.0.0.0/16**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r3drht4vozbdhc0xe2oq.png)
**Create a public subnet inside that VPC**
**Subnet name :- Pub-subnet**
**AZ :- ap-south-1b**
Ipv4 CIDR :- 11.0.1.0/24 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/up782rdon10i2bo7e7ot.png)
**Create a InternetGateway and attach it to your VPC**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/68t3hk617ocvxmye5ttr.png)
**Create a route table for subnet association**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/38nhrevqjcsrxmkq54cn.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e5j4oetk3wd2pmd4gu3j.png)
**Allow 0.0.0.0/0 inside route for internet access**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1e88d0w61x6xhiz9ph2p.png)

## Create a EC2 instance inside the public subnet
 
**Deploy a Window server**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xi477kggtclw8ohg4lrx.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o85h71ptjkkcqlvwv472.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bcw7octig6rqj38wqjcw.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v9hlbj1y41fuwwg8fgtp.png)

## Create IAM Role to allow Flow Logs to be sent to the CloudWatch Log Group

**First, we need to create an IAM Role there allows the Flow Logs to send data into a CloudWatch Log Group, so go to IAM > Roles and click Create role.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aft9smaykvbnz83v0wcf.png)
**Now select Custom trust policy under the Trusted entity type and add the vpc-flow-logs.amazonaws.com as a principal service.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xtcsjao8apetaevyqcjr.png)
**You should click next until you hit the review pages where you name your new role with a name you easily can find, this role can be reused every time you need a flow log role to send logs into CloudWatch Log Group.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2ztqy0mla5v61r7ajtdf.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/38azutmndymqfzryeepw.png)
**After you have created your role it can be found under your roles before we are finished with the role we need to attach an inline policy to it so click on your new role.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eepw8tosmmhnxtbo5aw0.png)
**Click add permissions > create inline policy to start editing your policy for this role.**
**Copy the policy into the inline policy and click next**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b9yuopyw3oasojis4o1b.png)
**You need to give the inline policy a name before you are finished with creating this inline policy for the role.**
**Now your role should end up with your new policy attached to your role as you created it and your role is now ready for use.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/73rswlyi4ssfwkjrnu1x.png)

## Create a CloudWatch Logs group

**Search for cloud watch and click on log groups**
**When you create the log group you need to change the retention settings to 3 months and give your log group a name, after that you can create your group.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xy94wyp33ue8k12j9ryy.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r1s9vozaca22kg499uiw.png)

## Create Flow Logs for your VPC

**To create a flow log you need to go for VPC and right-click on the VPC you want to create a flow log on, then click Create flow log.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eodynbvjp4st65ifd3wp.png)
**You need a name for your flow log and select your CloudWatch Log Group and the IAM Role you created before, use the AWS default format for logging.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p2thx0i2gq5ir18kh37i.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wmmykvq2cukdoultx1o8.png)
**When you have created your flow log you can see it by clicking on your VPC and going to Flow logs, here you can click on your destination name to visit the logs for this flow log.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/73pjmpq6fr87jbxa7hsr.png)
**Now you can see the log stream for each network eni-* click on the log stream you want to watch out for , Here No logs are there because nothing happended inside our network till now.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yvbdeqlgutsvxz8hkrhu.png)
**Now lets try to RDP inside the window server that we created earlier.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4g908eeyeyv0zumsiy0s.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eg8c5fwnrxgw0n0ckxz4.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2w2e1wrclqbei2nc5ozq.png)
**Now Go to log groups --> log streams**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/00sgy9hcuewwfpdnfxjd.png)
**Here You can able to watch all the logs**
**Each group will contain a separate stream for each Elastic Network Interface (ENI):**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c032uvo1sl8flfmuy79i.png)
**Each stream, in turn, contains a series of flow log records.**