Back to Checks
aws

VPC flow logs are enabled

vpc_flow_logs_enabled
Service: vpcSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:AwsEc2Vpc

AWS VPCs have Flow Logs configured to capture IP traffic for their network interfaces and deliver records to a logging destination.

VPCs lacking an active flow log configuration are highlighted.

Prowler logoProwlerprowler-provider-aws

Risk

Without flow logs, network activity is opaque, hindering detection and investigation of malicious traffic. Attackers can probe, exfiltrate, or move laterally unnoticed, impacting confidentiality and integrity; outages and misconfigurations are harder to diagnose, reducing availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks vpc_flow_logs_enabled

Recommendation

Enable VPC Flow Logs for all VPCs to provide baseline telemetry. Prefer capturing at least REJECT and, for sensitive networks, ALL. Send logs to a centralized, access-controlled destination with retention. Apply least privilege to writers/readers and integrate with monitoring for defense in depth.

Remediation

CLI

aws ec2 create-flow-logs --resource-type VPC --resource-ids <VPC_ID> --traffic-type ALL --log-destination-type s3 --log-destination arn:aws:s3:::<S3_BUCKET_NAME>

Terraform

# Enable VPC Flow Logs to S3 for an existing VPC
resource "aws_flow_log" "vpc" {
  vpc_id               = "<example_resource_id>"                 # Critical: target the VPC to enable flow logs
  traffic_type         = "ALL"                                   # Critical: log all traffic
  log_destination_type = "s3"                                    # Critical: send logs to S3 (no IAM role needed)
  log_destination      = "arn:aws:s3:::<example_resource_name>"  # Critical: S3 bucket ARN
}

NativeIaC

# CloudFormation: Enable VPC Flow Logs to S3 for an existing VPC
Resources:
  FlowLog:
    Type: AWS::EC2::FlowLog
    Properties:
      ResourceId: <example_resource_id>         # Critical: target the VPC ID
      ResourceType: VPC                         # Critical: enable flow logs at VPC level
      TrafficType: ALL                          # Critical: log all traffic
      LogDestinationType: s3                    # Critical: send logs to S3 (no IAM role needed)
      LogDestination: arn:aws:s3:::<example_resource_name>  # Critical: S3 bucket ARN

Other

1In the AWS Console, go to VPC > Your VPCs
2Select the target VPC
3Open the Flow logs tab and click Create flow log
4Set Traffic type to All
5Set Destination to S3 and enter Bucket ARN: arn:aws:s3:::<example_resource_name>
6Click Create flow log

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class vpc_flow_logs_enabled(Check):
    def execute(self):
        findings = []
        for vpc in vpc_client.vpcs.values():
            if vpc_client.provider.scan_unused_services or vpc.in_use:
                report = Check_Report_AWS(metadata=self.metadata(), resource=vpc)
                report.status = "FAIL"
                report.status_extended = (
                    f"VPC {vpc.name if vpc.name else vpc.id} Flow logs are disabled."
                )
                if vpc.flow_log:
                    report.status = "PASS"
                    report.status_extended = (
                        f"VPC {vpc.name if vpc.name else vpc.id} Flow logs are enabled."
                    )

                findings.append(report)

        return findings

References