Ensure VPC Flow Logs are Enabled

Rule Description:

Troubleshooting Steps:

2. 1.

   Verify AWS CloudTrail logging:

   • Confirm that AWS CloudTrail logging is enabled in your AWS account.
   • To enable CloudTrail, go to the AWS Management Console, navigate to the CloudTrail service, and follow the instructions to enable it.
4. 2.

   Check IAM permissions:

   • Ensure that you have sufficient IAM permissions to enable VPC flow logs.
   • You need the necessary permissions to modify VPC flow logs settings and create associated resources.
   • If you don't have the required permissions, contact your AWS account administrator.
6. 3.

   Verify VPC configuration:

   • Check if your VPC has the required configurations to enable flow logs.
   • Ensure that your VPC has an associated flow log resource.
   • If there is no flow log resource associated with the VPC, follow the remediation steps mentioned below.
8. 4.

   Review flow log configurations:

   • If VPC flow logs are already enabled but not complying with NIST 800-53 Revision 5, review the configurations to ensure they meet compliance requirements.
   • Check if you are capturing the required information such as source/destination IP addresses, ports, protocols, etc.
10. 5.

    Apply remediation steps:

    • If VPC flow logs are not currently enabled or not compliant, perform the remediation steps mentioned below.

Remediation Steps:

2. 1.

   Open the AWS Management Console:

   • Sign in to the AWS Management Console using your AWS account credentials.
4. 2.

   Navigate to Amazon VPC service:

   • In the AWS Management Console, search and select the "VPC" service or navigate to it from the services menu.
6. 3.

   Select the desired VPC:

   • From the VPC dashboard, select the specific VPC for which you want to enable flow logs.
8. 4.

   Click on "Flow Logs":

   • In the "Details" tab for the selected VPC, click on the "Flow Logs" option.
10. 5.

    Click "Create Flow Log":

    • In the Flow Logs page, click on the "Create Flow Log" button.
12. 6.

    Configure the flow log settings:

    • Provide a unique name for the flow log in the "Flow Log Name" field.
    • Select the target where the flow logs should be delivered (e.g., an Amazon S3 bucket or CloudWatch Logs group).
    • Choose whether to capture all traffic or specific subnets, network interfaces, or VPC endpoints.
    • Specify the IAM role that grants necessary permissions for delivering the flow logs.
    • Optionally, choose to enable or disable "Accept traffic from peered VPCs."
    • Ensure the "Enabled" checkbox is selected.
14. 7.

    Click "Create":

    • Once you have configured the desired settings, click on the "Create" button.
16. 8.

    Verify flow log creation:

    • Confirm that the flow log has been created and appears in the list of flow logs for the selected VPC.
18. 9.

    Validate flow logs:

    • Review the flow logs to ensure they are functioning correctly.
    • Confirm that the flow logs capture the required information specified in the NIST 800-53 guidelines.

Conclusion: