Back to Checks
gcp

Subnet has VPC Flow Logs enabled

compute_subnet_flow_logs_enabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:compute.googleapis.com/Subnetwork

GCP VPC subnets have VPC Flow Logs enabled at the subnet scope to capture connection metadata for traffic to and from VM interfaces.

Prowler logoProwlerprowler-provider-gcp

Risk

Without VPC Flow Logs, network activity lacks visibility, weakening detection and response. Blind spots enable covert data exfiltration (C), undetected lateral movement and policy bypass (I), and hinder containment and recovery (A). Forensics and cost insights are degraded.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_subnet_flow_logs_enabled

Recommendation

Enable VPC Flow Logs on all production subnets. Tune aggregation, sampling, and metadata to balance visibility and cost.

Export to centralized logging for analytics and alerting, apply least privilege to log access, and use organization guardrails to enforce consistent coverage as part of defense in depth.

Remediation

CLI

gcloud compute networks subnets update <SUBNET_NAME> --region <REGION> --enable-flow-logs

Terraform

resource "google_compute_subnetwork" "<example_resource_name>" {
  name          = "<example_resource_name>"
  ip_cidr_range = "10.0.0.0/24"
  region        = "<REGION>"
  network       = "<VPC_NETWORK_SELF_LINK>"

  enable_flow_logs = true # Critical: enables VPC Flow Logs so the subnet passes the check
}

Other

1In the Google Cloud console, go to Networking > VPC networks
2Open the Subnets tab and click the target subnet
3Click Edit
4Set Flow logs to On
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_subnet_flow_logs_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for subnet in compute_client.subnets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=subnet)
            report.status = "PASS"
            report.status_extended = f"Subnet {subnet.name} in network {subnet.network} has flow logs enabled."
            if not subnet.flow_logs:
                report.status = "FAIL"
                report.status_extended = f"Subnet {subnet.name} in network {subnet.network} does not have flow logs enabled."
            findings.append(report)

        return findings

References