Policy Packs

guardrails-samples

ensures that all network flow logs are captured and stored in CloudWatch Log Groups, enabling efficient detection of anomalous activity, troubleshooting of network issues, and compliance with security best practices and regulatory requirements.

Enforce Flow Logging to CloudWatch Log Groups Is Enabled for AWS VPCs

main

aws_vpc_vpc_flow_logging

Configure VPC Flow logging for the VPC.&#92;n&#92;nVPC Flow Logs is a feature that enables you to capture information about&#92;nthe IP traffic going to and from network interfaces in your VPC. Flow log&#92;ndata can be published to Amazon CloudWatch Logs and Amazon S3.&#92;n

vpcFlowLogging

AWS > VPC > VPC > Flow Logging

aws_vpc_vpc_flow_logging_cloudwatch

Configure VPC flow logs to be sent to a CloudWatch Log Group,&#92;nper the `Flow Logging &gt; CloudWatch &gt; *` policies&#92;n

vpcFlowLoggingCloudWatch

AWS > VPC > VPC > Flow Logging > Cloud Watch

aws_vpc_vpc_flow_logging_cloudwatch_log_group

The name of a CloudWatch Log Group to which the VPC flow logs will be delivered.&#92;nNote the following&#92;n  - If no log group exists with this name exists, one will be created&#92;n  - If an existing log group exists with the same name, it will be used&#92;n  - The log group will **NOT** be deleted if flow logging is disabled&#92;n

vpcFlowLoggingCloudWatchLogGroup

AWS > VPC > VPC > Flow Logging > Cloud Watch > Log Group

aws_vpc_vpc_flow_logging_cloudwatch_role

The name of an IAM role that Flow Logging will assume to write logs to CloudWatch logs.&#92;nIf CloudWatch Log forwarding is enabled, you must also specify a role that CloudTrail can assume to write the logs.  This role must have the correct access for the CloudWatch Log Group, and must allow the CloudTrail Service (cloudtrail.amazonaws.com) the ability to assume the role&#92;nThe role must already exist - the stack wont create it

Developers