AWS VPC Flow Logs not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_11
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	58dbed8c-b9d5-4059-8891-ab0de8283cdd

Impact

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you have created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. VPC Flow Logs provide visibility into network traffic that traverses the VPC. We recommend that VPC Flow Logs are enabled for packet Rejects for VPCs to help detect anomalous traffic and insight during security workflows.

How to Fix

Resource: aws_flow_log + aws_vpc

• Arguments: vpc_id (of aws_flow_log) [source,go]

---

resource "aws_flow_log" "example" { iam_role_arn = "arn" log_destination = "log" traffic_type = "ALL"

• vpc_id = aws_vpc.ok_vpc.id }

resource "aws_vpc" "ok_vpc" { cidr_block = "10.0.0.0/16" }