VPC Network Route Logging Remediation

Triage and Remediation

Remediation

Remediation

Using Console

Here’s how to enable VPC Route Logging for a GCP VPC network via the GCP Console:

Go to VPC networks
- In the Google Cloud console, go to:
  Navigation menu (☰) → VPC network → VPC networks
Select the VPC network
- Click the name of the VPC network that contains the subnet(s) you want to enable route logging for.
Open the Subnets list
- In the VPC network details page, go to the Subnets tab.
- Find the subnet where you want to enable route logging.
- Click the Subnet name to open its details.
Edit the subnet
- At the top of the subnet details page, click Edit.
Enable Route Logging
- Scroll down to the Logs section.
- You should see options such as:
  - VPC flow logs
  - Route logs
- Set Route logs to On.
- (Optional but recommended) Adjust:
  - Aggregation interval
  - Sampling (e.g., 1.0 for all)
  - Metadata level
  - Filter (All, Include, or Exclude certain traffic)
Save changes
- Scroll down and click Save.
Verify logs in Cloud Logging
- Go to Navigation menu (☰) → Logging → Logs Explorer.
- In the query builder, choose:
  - Resource type: gce_subnetwork or gce_instance (depending how you want to filter)
  - Log name typically includes: vpc_route or similar, depending on UI changes.
- Run the query and confirm that route logs are appearing.

Repeat steps 3–6 for each subnet where you need route logging enabled.

Using CLI

To address “VPC Network Route Logging” findings in GCP, what most tools are actually flagging is the lack of VPC Flow Logs on subnets. You remediate this by enabling flow logs on each subnet via gcloud.

Below are step‑by‑step CLI instructions.

1. List all subnets and see which have Flow Logs disabled

gcloud compute networks subnets list \
  --format="table(name,region,network,enableFlowLogs)"

Look for subnets where enableFlowLogs is False or empty.

2. Enable VPC Flow Logs on a specific subnet

Basic enablement with default settings:

gcloud compute networks subnets update SUBNET_NAME \
  --region=REGION \
  --enable-flow-logs

Replace:

SUBNET_NAME with your subnet name.
REGION with the subnet’s region (e.g. us-central1).

3. (Optional) Configure advanced logging options

If you want finer control (recommended for production), use:

gcloud compute networks subnets update SUBNET_NAME \
  --region=REGION \
  --enable-flow-logs \
  --logging-aggregation-interval=INTERVAL \
  --logging-flow-sampling=SAMPLING_RATIO \
  --logging-metadata=INCLUDE_ALL_METADATA|EXCLUDE_ALL_METADATA|CUSTOM_METADATA

Examples:

# Example: 5-minute aggregation, 0.5% sampling, include all metadata
gcloud compute networks subnets update my-subnet \
  --region=us-central1 \
  --enable-flow-logs \
  --logging-aggregation-interval=interval-5-min \
  --logging-flow-sampling=0.005 \
  --logging-metadata=INCLUDE_ALL_METADATA

Common values:

--logging-aggregation-interval:
- interval-5-min, interval-10-min, interval-15-min, interval-30-min, interval-1-min
--logging-flow-sampling:
- 0.0–1.0 (e.g. 0.5 = 50%, 0.005 = 0.5%)
--logging-metadata:
- INCLUDE_ALL_METADATA, EXCLUDE_ALL_METADATA, CUSTOM_METADATA

4. Verify that Flow Logs are enabled

gcloud compute networks subnets describe SUBNET_NAME \
  --region=REGION \
  --format="flattened(enableFlowLogs,logConfig)"

Confirm enableFlowLogs: true and that logConfig matches your desired settings.

5. Repeat for all required subnets

You can loop through all subnets in a network:

NETWORK_NAME="YOUR_VPC_NETWORK"

for REGION in $(gcloud compute networks subnets list \
                  --filter="network:${NETWORK_NAME}" \
                  --format="value(region)" | sort -u); do
  for SUBNET in $(gcloud compute networks subnets list \
                    --filter="network:${NETWORK_NAME} AND region:${REGION}" \
                    --format="value(name)"); do
    gcloud compute networks subnets update "$SUBNET" \
      --region="$REGION" \
      --enable-flow-logs
  done
done

If your finding truly refers to a different, specific “route logging” feature (e.g., from a particular security tool), share the exact tool / rule ID and I can tailor the exact gcloud commands.

Using Python

To remediate “VPC Network Route Logging” findings in GCP, you typically enable VPC Flow Logs on all subnets of the affected VPC network. These logs provide route-level visibility (next hop, route, etc.) via Cloud Logging.

Below is how to do this using Python and the Compute Engine API.

1. Prerequisites

Install libraries:

pip install google-api-python-client google-auth google-auth-httplib2

Make sure your environment is authenticated, e.g.:

gcloud auth application-default login

Ensure the account has:

roles/compute.networkAdmin (or equivalent custom role)

2. Python script to enable VPC Flow Logs on all subnets in a VPC

from googleapiclient import discovery
from google.auth import default

PROJECT_ID = "YOUR_PROJECT_ID"
NETWORK_NAME = "YOUR_VPC_NETWORK_NAME"  # e.g., "default"

def main():
    credentials, _ = default()
    compute = discovery.build("compute", "v1", credentials=credentials)

    # 1. List all subnetworks in the project
    request = compute.subnetworks().aggregatedList(project=PROJECT_ID)
    all_subnetworks = []

    while request is not None:
        response = request.execute()
        for region, region_data in response.get("items", {}).items():
            for subnetwork in region_data.get("subnetworks", []):
                all_subnetworks.append(subnetwork)
        request = compute.subnetworks().aggregatedList_next(
            previous_request=request, previous_response=response
        )

    # 2. Filter subnetworks that belong to the specified VPC network
    target_subnetworks = [
        s for s in all_subnetworks
        if s.get("network", "").endswith("/networks/" + NETWORK_NAME)
    ]

    # 3. Enable flow logs on each subnetwork (if disabled)
    for s in target_subnetworks:
        if s.get("enableFlowLogs"):
            print(f"Flow logs already enabled for: {s['name']} ({s['region']})")
            continue

        subnetwork_name = s["name"]
        subnetwork_region = s["region"].split("/")[-1]

        # Subnetwork patch body: keep existing fields, just set enableFlowLogs and logConfig
        body = {
            "enableFlowLogs": True,
            "logConfig": {
                "aggregationInterval": "INTERVAL_5_MIN",      # e.g. 5-minute aggregation
                "flowSampling": 0.5,                          # 50% sampling
                "metadata": "INCLUDE_ALL_METADATA",           # or "EXCLUDE_ALL_METADATA"/"CUSTOM_METADATA"
            }
        }

        print(f"Enabling flow logs for: {subnetwork_name} ({subnetwork_region})")
        request = compute.subnetworks().patch(
            project=PROJECT_ID,
            region=subnetwork_region,
            subnetwork=subnetwork_name,
            body=body,
        )
        response = request.execute()
        print(f"Operation started: {response.get('name')}")

if __name__ == "__main__":
    main()

3. What this achieves

Enumerates all subnetworks in the project.
Filters those in the specified VPC network.
For each subnetwork, enables enableFlowLogs and configures a logConfig, which results in flow + route logging going to Cloud Logging.

Adjust aggregationInterval, flowSampling, and metadata as per your org’s logging/volume requirements.

Using Terraform

# There is currently no Terraform argument on any google_* resource
# that enables or configures GCP "VPC Network Route Logging".
#
# Route logging is controlled only by GCP itself (Console / gcloud),
# not exposed via the google provider yet, so it cannot be remediated
# directly in Terraform.

# You must enable it outside Terraform, for example:
# - In the Console: VPC Network → Routes → Route logging settings,
#   then enable route logging for the desired network(s); or
# - With gcloud: use the documented `gcloud compute` commands
#   for route logging once they are available in your SDK.

# After doing so, `terraform plan` will show no changes related to
# route logging, because the provider cannot manage that setting.

Triage and Remediation​

Remediation​

1. List all subnets and see which have Flow Logs disabled​

2. Enable VPC Flow Logs on a specific subnet​

3. (Optional) Configure advanced logging options​

4. Verify that Flow Logs are enabled​

5. Repeat for all required subnets​

1. Prerequisites​

2. Python script to enable VPC Flow Logs on all subnets in a VPC​

3. What this achieves​