VPC flow logs are enabled

Check ID: vpc_flow_logs_enabled
Provider: AWS
Service: vpc
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: AwsEc2Vpc

What this check verifies

AWS VPCs have Flow Logs configured to capture IP traffic for their network interfaces and deliver records to a logging destination. VPCs lacking an active flow log configuration are highlighted.

Risk

Without flow logs, network activity is opaque, hindering detection and investigation of malicious traffic. Attackers can probe, exfiltrate, or move laterally unnoticed, impacting confidentiality and integrity; outages and misconfigurations are harder to diagnose, reducing availability.

Recommendation

Enable VPC Flow Logs for all VPCs to provide baseline telemetry. Prefer capturing at least REJECT and, for sensitive networks, ALL. Send logs to a centralized, access-controlled destination with retention. Apply least privilege to writers/readers and integrate with monitoring for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 create-flow-logs --resource-type VPC --resource-ids <VPC_ID> --traffic-type ALL --log-destination-type s3 --log-destination arn:aws:s3:::<S3_BUCKET_NAME>

# Enable VPC Flow Logs to S3 for an existing VPC
resource "aws_flow_log" "vpc" {
  vpc_id               = "<example_resource_id>"                 # Critical: target the VPC to enable flow logs
  traffic_type         = "ALL"                                   # Critical: log all traffic
  log_destination_type = "s3"                                    # Critical: send logs to S3 (no IAM role needed)
  log_destination      = "arn:aws:s3:::<example_resource_name>"  # Critical: S3 bucket ARN
}

# CloudFormation: Enable VPC Flow Logs to S3 for an existing VPC
Resources:
  FlowLog:
    Type: AWS::EC2::FlowLog
    Properties:
      ResourceId: <example_resource_id>         # Critical: target the VPC ID
      ResourceType: VPC                         # Critical: enable flow logs at VPC level
      TrafficType: ALL                          # Critical: log all traffic
      LogDestinationType: s3                    # Critical: send logs to S3 (no IAM role needed)
      LogDestination: arn:aws:s3:::<example_resource_name>  # Critical: S3 bucket ARN

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = vpc_flow_logs_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

VPC endpoint service allows only trusted principals or none VPC peering route tables follow least privilege

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires