cis-aws-foundations-4-7

name	cis-aws-foundations-4.7
description	Ensure VPC flow logging is enabled in all VPCs
category	cis-logging
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","logging","vpc","flow-logs","network","cloudwatch"]
cis_id	4.7
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-4.1"]
prerequisites	[]
severity_boost	{}

Ensure VPC flow logging is enabled in all VPCs

Description

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Rejects" for VPCs.

Rationale

VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or gain insights during security workflows.

Impact

By default, CloudWatch Logs will store logs indefinitely unless a specific retention period is defined for the log group. When choosing the number of days to retain, keep in mind that the average time it takes for an organization to realize they have been breached is 210 days (at the time of this writing). Since additional time is required to research a breach, a minimum retention policy of 365 days allows for detection and investigation. You may also wish to archive the logs to a cheaper storage service rather than simply deleting them. See the following AWS resource to manage CloudWatch Logs retention periods:

1. https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html

Audit Procedure

Using AWS Console

1. Sign into the management console.
2. Select Services, then select VPC.
3. In the left navigation pane, select Your VPCs.
4. Select a VPC.
5. In the right pane, select the Flow Logs tab.
6. Ensure a Log Flow exists that has Active in the Status column.

Using AWS CLI

1. Run the describe-vpcs command (OSX/Linux/UNIX) to list the VPC networks available in the current AWS region:

aws ec2 describe-vpcs --region <region> --query Vpcs[].VpcId

The command output returns the VpcId of VPCs available in the selected region.

2. Run the describe-flow-logs command (OSX/Linux/UNIX) using the VPC ID to determine if the selected virtual network has the Flow Logs feature enabled:

aws ec2 describe-flow-logs --filter "Name=resource-id,Values=<vpc-id>"

If there are no Flow Logs created for the selected VPC, the command output will return an empty list .