Back to Checks
alibabacloud

VPC flow logging is enabled for all VPCs

vpc_flow_logs_enabled
Service: vpcSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:ALIYUN::VPC::FlowLog

Alibaba Cloud VPC Flow Logs capture IP traffic information for Elastic Network Interfaces, VSwitches, or entire VPCs. When a flow log is created for a VPC, all ENIs within it, including newly created ones, are automatically monitored. Flow log data is stored in Log Service where it can be viewed and analyzed for security and operational purposes.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Without VPC Flow Logs enabled, there is no visibility into network traffic traversing the VPC. This prevents detection of anomalous traffic patterns, unauthorized network connections, and data exfiltration attempts, and severely limits the ability to investigate network-based security incidents.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks vpc_flow_logs_enabled

Recommendation

Enable VPC Flow Logs for all VPCs to capture IP traffic information and store it in Log Service for security analysis, anomaly detection, and incident response.

Remediation

CLI

aliyun vpc CreateFlowLog --ResourceId <vpc_id> --ResourceType VPC --FlowLogName <flow_log_name> --LogStoreName <log_store_name> --ProjectName <project_name>

Terraform

resource "alicloud_vpc_flow_log" "example" {
  flow_log_name  = "example-flow-log"
  resource_type  = "VPC"
  resource_id    = alicloud_vpc.example.id
  traffic_type   = "All"
  project_name   = alicloud_log_project.example.project_name
  log_store_name = alicloud_log_store.example.logstore_name
}

Other

1Log on to the **VPC Console**
2In the left-side navigation pane, click **FlowLog**
3Click **Create Flow Log**
4Select the target VPC as the resource
5Configure the Log Service project and logstore for storing flow log data
6Click **OK** to enable flow logging

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.vpc.vpc_client import vpc_client


class vpc_flow_logs_enabled(Check):
    """Check if VPC flow logging is enabled in all VPCs."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for vpc in vpc_client.vpcs.values():
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=vpc)
            report.region = vpc.region
            report.resource_id = vpc.id
            report.resource_arn = (
                f"acs:vpc:{vpc.region}:{vpc_client.audited_account}:vpc/{vpc.id}"
            )

            if vpc.flow_log_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"VPC {vpc.name if vpc.name else vpc.id} has flow logs enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"VPC {vpc.name if vpc.name else vpc.id} does not have flow logs enabled."

            findings.append(report)

        return findings

References