VPC Flow Logs Should Be Enabled
More Info:
Ensures VPC flow logs are enabled for traffic logging.Risk Level
LowAddress
SecurityCompliance Standards
CISGCP, CBP, HIPAA, ISO27001, NISTTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “VPC Flow Logs Should Be Enabled” for GCP using GCP console, follow these steps:
- Open the Google Cloud Console and navigate to the VPC network that you want to enable flow logs for.
- Click on the “VPC network details” button.
- In the “VPC network details” page, click on the “Logs” tab.
- Click on the “Configure logs” button.
- In the “Configure logs” page, select the “VPC flow logs” option.
- Choose the “Create a new sink” option.
- Enter a name for the new sink and select the destination for the logs.
- Click on the “Create sink” button.
- Once the sink is created, click on the “Save” button.
- The VPC flow logs are now enabled for the selected VPC network.
Using CLI
Using CLI
To remediate the misconfiguration of VPC Flow Logs not being enabled in GCP using GCP CLI, you can follow the below steps:After following these steps, VPC Flow Logs will be enabled for the selected VPC network in GCP.
- Open the Google Cloud Console and navigate to the VPC network for which you want to enable Flow Logs.
- Click on the “Edit” button to edit the VPC network settings.
- Scroll down to the “Flow Logs” section and click on the “Add Flow Logs” button.
- In the “Add Flow Logs” dialog box, select the “All VPC network flows” option to capture all the network flows, or select the “Selected subnet flows” option to capture the network flows of specific subnets.
- Select the “Cloud Storage” option as the destination for the Flow Logs.
- Choose the bucket where you want to store the logs or create a new bucket.
- Click on the “Create” button to enable the Flow Logs for the selected VPC network.
- Set the environment variables:
- Create a flow log filter:
- Create a flow log configuration:
Using Python
Using Python
To remediate the misconfiguration “VPC Flow Logs Should Be Enabled” for GCP using Python, you can follow the below steps:
- First, you need to enable VPC flow logs for all the subnets in your GCP project. You can use the following command to enable VPC flow logs for a subnet:
- You can create a script to run the above command for all the subnets in your GCP project.
- You can schedule the above script to run periodically to ensure that VPC flow logs are always enabled for all the subnets in your GCP project.