Check ID: network_vcn_subnet_flow_logs_enabled
Provider: Oracle Cloud (OCI)
Service: network
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: Subnet

​
What this check verifies

OCI subnets in a VCN have network flow logging configured. Evaluation considers an active flowlogs configuration targeting the VCN or the specific subnet in the same region and associated with a log group.

​
Risk

Without flow logs, east-west and ingress/egress traffic is opaque, weakening detection and forensics. Scans, data exfiltration, and lateral movement can go unnoticed, undermining confidentiality and integrity, and delaying response to availability threats like DDoS.

​
Recommendation

Enable VCN flow logs for all subnets-prefer VCN-wide enablement for complete coverage-and route to centralized log groups. Enforce least privilege on log access, set retention, and integrate with a SIEM. Use capture filters and sampling to control volume. Review logs to support defense-in-depth.

​
Remediation

# Enable VCN flow logs (covers all subnets in the VCN)
resource "oci_logging_log" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  log_group_id = "<example_resource_id>"          # Existing Log Group OCID
  log_type     = "SERVICE"
  is_enabled   = true

  configuration {
    source {
      source_type = "OCISERVICE"
      service     = "flowlogs"                     # CRITICAL: enables VCN/Subnet flow logging
      resource    = "<example_resource_id>"       # CRITICAL: VCN OCID (use subnet OCID if enabling per-subnet)
      category    = "vcn"                          # CRITICAL: set to "vcn" (or "subnet" for subnet-level)
      parameters  = { capture_filter = "<example_resource_id>" }  # Capture Filter OCID
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = network_vcn_subnet_flow_logs_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks