Skip to main content

GCP VPC Network Logging - Security Rule

More Info:​

Ensures that logging and log alerts exist for VPC network changes.

Risk Level​

Medium

Address​

Security

Compliance Standards​

HIPAA, PCI

Triage and Remediation​

Remediation​

Using Console

To remediate missing VPC Network Logging (VPC Flow Logs) in GCP using the Console, enable flow logs on each subnet:

  1. Sign in and go to VPC networks

    • Go to: https://console.cloud.google.com/
    • Make sure you’re in the correct project.
    • In the left menu, go to VPC network → VPC networks.

  2. Select the VPC network

    • Click the name of the VPC network where you want logging enabled.
    • You’ll see a list of Subnets for that VPC.

  3. Edit each subnet to enable flow logs

    • For each subnet that should have logging:
      1. Click the three dots (⋮) at the end of the subnet row and choose Edit subnet (or click the subnet name, then click Edit).
      2. Find the Flow logs setting.
      3. Set Flow logs to On.
      4. (Optional but recommended) Configure:
        • Aggregation interval (e.g., 5 min for more detail, or 30 min for less cost).
        • Sampling (e.g., 0.5 or 1.0 for security-focused environments).
        • Metadata (e.g., “Include all metadata” for richer logs; adjust if you have privacy or cost constraints).
        • Filter (e.g., “All” for all traffic, or more restrictive if you have a specific policy).

  4. Choose the destination (if prompted)

    • By default, VPC Flow Logs are exported to Cloud Logging.
    • If needed, set up sinks later (Logging → Logs Router) to send logs to:
      • Cloud Storage (archival),
      • BigQuery (analytics),
      • Pub/Sub (streaming to SIEM or other tools).

  5. Save the changes

    • Click Save at the bottom of the Edit subnet page.
    • Repeat for every subnet that must have VPC Flow Logs enabled.

  6. Verify logs are arriving

    • Go to Logging → Logs Explorer.
    • In the query builder, set:
      • Resource type: gce_subnetwork
      • Or use a simple query like: 
        resource.type="gce_subnetwork"
        logName:"logs/compute.googleapis.com%2Fvpc_flows"
    • Run the query and confirm you see new flow log entries.

If you tell me your compliance baseline (e.g., CIS, PCI, internal standard), I can recommend specific aggregation, sampling, and metadata settings.

Using CLI

Below are step‑by‑step GCP CLI instructions to enable VPC Network Logging, covering both:

  • VPC Flow Logs (subnet-level)
  • Firewall Rule Logging (rule-level)

Adjust names/regions/project as needed.

1. Prerequisites​

# Set your project
gcloud config set project PROJECT_ID

# (Optional) set default region/zone
gcloud config set compute/region REGION
gcloud config set compute/zone ZONE

2. Enable VPC Flow Logs on a Subnet​

VPC Flow Logs are configured per subnet.

2.1. List existing subnets​

gcloud compute networks subnets list \
  --project=PROJECT_ID

Note the NAME, REGION, and NETWORK of the subnet you want to fix.

2.2. Check current flow log status for a subnet​

gcloud compute networks subnets describe SUBNET_NAME \
  --region=REGION \
  --project=PROJECT_ID \
  --format="get(enableFlowLogs)"

If blank/false, logs are not enabled.

2.3. Enable flow logs for the subnet​

Basic enablement (default logging config):

gcloud compute networks subnets update SUBNET_NAME \
  --region=REGION \
  --enable-flow-logs \
  --project=PROJECT_ID

2.4. (Optional) Tune flow log sampling & aggregation​

Example: sample 0.5, aggregation interval 5 min, metadata with filter:

gcloud compute networks subnets update SUBNET_NAME \
  --region=REGION \
  --enable-flow-logs \
  --flow-sampling=0.5 \
  --aggregation-interval=INTERVAL_5_MIN \
  --metadata=INCLUDE_ALL_METADATA \
  --metadata-fields=source.region,source.tags,destination.region,destination.tags \
  --project=PROJECT_ID

Common --aggregation-interval values:

  • INTERVAL_5_SEC
  • INTERVAL_30_SEC
  • INTERVAL_1_MIN
  • INTERVAL_5_MIN
  • INTERVAL_10_MIN
  • INTERVAL_15_MIN

3. Enable Logging for Firewall Rules​

Firewall logging is configured per firewall rule.

3.1. List firewall rules​

gcloud compute firewall-rules list \
  --project=PROJECT_ID

Identify the rule(s) you want to log.

3.2. Check logging status of a firewall rule​

gcloud compute firewall-rules describe FIREWALL_RULE_NAME \
  --project=PROJECT_ID \
  --format="get(logConfig.enable)"

3.3. Enable logging for a firewall rule​

Log both allowed and denied traffic:

gcloud compute firewall-rules update FIREWALL_RULE_NAME \
  --enable-logging \
  --project=PROJECT_ID

(Optional) Log only denied or only allowed traffic:

# Only denied
gcloud compute firewall-rules update FIREWALL_RULE_NAME \
  --enable-logging \
  --logging-metadata=INCLUDE_ALL_METADATA \
  --logging-aggregation-interval=INTERVAL_5_MIN \
  --logging-severity=NOTICE \
  --logging-options=log-denied,evaluate-default-log-deny \
  --project=PROJECT_ID

(Note: exact logging options flags may vary; in many environments --enable-logging is sufficient, and log routing is handled via Cloud Logging sinks.)

4. Verify Logs Are Being Generated​

4.1. In Cloud Logging (via CLI)​

List log names that contain VPC flow logs:

gcloud logging logs list \
  --project=PROJECT_ID \
  --filter="compute.googleapis.com/vpc_flows"

List log names that contain firewall logs:

gcloud logging logs list \
  --project=PROJECT_ID \
  --filter="compute.googleapis.com/firewall"

View recent VPC flow log entries:

gcloud logging read \
  'logName:"compute.googleapis.com/vpc_flows"' \
  --project=PROJECT_ID \
  --limit=10 \
  --format="json"

View recent firewall log entries:

gcloud logging read \
  'logName:"compute.googleapis.com/firewall"' \
  --project=PROJECT_ID \
  --limit=10 \
  --format="json"

If you share your PROJECT_ID, subnet name, and region, I can give you the exact commands filled in.

Using Python

For GCP “VPC Network Logging” you typically mean VPC Flow Logs on subnetworks (and optionally firewall rule logging). Below is how to enable VPC Flow Logs on one or more subnetworks using Python.

1. Prerequisites​

  1. A GCP project and VPC subnet(s) already created.
  2. Permissions:
    • compute.subnetworks.update
    • Often via roles like roles/compute.networkAdmin.
  3. Local setup: 
    pip install google-api-python-client google-auth google-auth-httplib2 google-auth-oauthlib
  4. Authentication (any one):
    • gcloud auth application-default login (for local/dev)
    • Or run in a service account context with proper roles.

2. Enable VPC Flow Logs on a Subnetwork (Python)​

This uses the compute.subnetworks.patch method and sets enableFlowLogs: true.

from googleapiclient.discovery import build
from google.oauth2 import service_account
import time

PROJECT_ID = "YOUR_PROJECT_ID"
REGION = "us-central1"          # Region of the subnetwork
SUBNETWORK_NAME = "your-subnet" # Name of the subnetwork

# 1. Get credentials
# Option A: Use Application Default Credentials
#   gcloud auth application-default login
#   Then:
#   from google.auth import default
#   creds, _ = default()
#
# Option B: Use service account key file:
SERVICE_ACCOUNT_FILE = "path/to/service-account.json"
creds = service_account.Credentials.from_service_account_file(
    SERVICE_ACCOUNT_FILE,
    scopes=["https://www.googleapis.com/auth/cloud-platform"],
)

# 2. Build Compute Engine API client
compute = build("compute", "v1", credentials=creds)

# 3. Get current subnetwork configuration
subnetwork = compute.subnetworks().get(
    project=PROJECT_ID,
    region=REGION,
    subnetwork=SUBNETWORK_NAME,
).execute()

# 4. Modify subnetwork to enable flow logs (and optionally customize settings)
body = {
    "enableFlowLogs": True,
    "logConfig": {
        # OPTIONAL – customize as needed
        "aggregationInterval": "INTERVAL_5_SEC",  # or INTERVAL_30_SEC, INTERVAL_1_MIN, etc.
        "flowSampling": 0.5,                     # 0.0–1.0
        "metadata": "INCLUDE_ALL_METADATA",      # or "EXCLUDE_ALL_METADATA", "CUSTOM_METADATA"
        # "metadataFields": ["k1", "k2"]         # only if using CUSTOM_METADATA
    },
}

# 5. Patch the subnetwork
operation = compute.subnetworks().patch(
    project=PROJECT_ID,
    region=REGION,
    subnetwork=SUBNETWORK_NAME,
    body=body,
).execute()

print(f"Patch operation started: {operation['name']}")

# 6. Wait for the operation to complete (optional but recommended)
def wait_for_regional_op(compute, project, region, op_name):
    while True:
        result = compute.regionOperations().get(
            project=project, region=region, operation=op_name
        ).execute()

        if result.get("status") == "DONE":
            if "error" in result:
                raise RuntimeError(result["error"])
            print("Operation completed.")
            return
        time.sleep(3)

wait_for_regional_op(compute, PROJECT_ID, REGION, operation["name"])

3. Enable Flow Logs on All Subnets in a VPC Network (Python)​

If you want to turn on logs for every subnetwork in a given VPC network:

NETWORK_NAME = "your-vpc-network"

# 1. List subnetworks filtered by network
request = compute.subnetworks().list(
    project=PROJECT_ID,
    region=REGION,
    filter=f'network eq .*{NETWORK_NAME}$'
)

while request is not None:
    response = request.execute()
    for subnetwork in response.get("items", []):
        sub_name = subnetwork["name"]
        print(f"Enabling flow logs on subnetwork: {sub_name}")

        body = {
            "enableFlowLogs": True,
            "logConfig": {
                "aggregationInterval": "INTERVAL_5_SEC",
                "flowSampling": 0.5,
                "metadata": "INCLUDE_ALL_METADATA",
            },
        }

        op = compute.subnetworks().patch(
            project=PROJECT_ID,
            region=REGION,
            subnetwork=sub_name,
            body=body,
        ).execute()

        wait_for_regional_op(compute, PROJECT_ID, REGION, op["name"])

    request = compute.subnetworks().list_next(
        previous_request=request, previous_response=response
    )

Run that for each region where your VPC has subnetworks.

4. (Optional) Firewall Rule Logging via Python​

If your “VPC Network Logging” requirement also includes firewall rule logging:

FIREWALL_NAME = "your-firewall-rule"

body = {
    "logConfig": {
        "enable": True
    }
}

op = compute.firewalls().patch(
    project=PROJECT_ID,
    firewall=FIREWALL_NAME,
    body=body,
).execute()

def wait_for_global_op(compute, project, op_name):
    while True:
        result = compute.globalOperations().get(
            project=project, operation=op_name
        ).execute()

        if result.get("status") == "DONE":
            if "error" in result:
                raise RuntimeError(result["error"])
            print("Operation completed.")
            return
        time.sleep(3)

wait_for_global_op(compute, PROJECT_ID, op["name"])

If you tell me your exact project/region/VPC/subnet naming pattern or whether this should be part of a CI/CD script, I can tailor the code further (e.g., idempotent check, environment‑based config).

Using Terraform
resource "google_compute_subnetwork" "vpc_subnet" {
  name          = "SUBNET_NAME"          # replace with your subnet name
  ip_cidr_range = "CIDR_BLOCK"           # e.g. "10.0.0.0/24"
  region        = "REGION"               # e.g. "us-central1"
  network       = google_compute_network.vpc.id

  # Enable VPC Flow Logs (Network Logging)
  log_config {
    aggregation_interval = "INTERVAL_5_SEC"   # or INTERVAL_30_SEC, INTERVAL_1_MIN, etc.
    flow_sampling        = 0.5                # 0.0–1.0, fraction of flows to log
    metadata             = "INCLUDE_ALL_METADATA"

    # Optional fine‑grained filters (require newer provider / API):
    # metadata_fields = ["connection", "src_instance", "dest_instance"]
    # filter_expr     = "true"  # log all flows (default behavior)
  }
}

Enabling or changing log_config on an existing subnetwork is an in‑place update and does not force replacement of the subnetwork.

For an already‑managed subnetwork, just add or adjust the log_config block in its existing google_compute_subnetwork resource.

Verification: terraform plan should show an update to the google_compute_subnetwork with log_config being added or modified, and no -/+ replacement for the subnetwork.

Additional Reading:​