3.9 Ensure VPC flow logging is enabled in all VPCs

Information

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet 'Rejects' for VPCs.

Rationale:

VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.

Impact:

By default, CloudWatch Logs will store Logs indefinitely unless a specific retention period is defined for the log group. When choosing the number of days to retain, keep in mind the average days it takes an organization to realize they have been breached is 210 days (at the time of this writing). Since additional time is required to research a breach, a minimum 365 day retention policy allows time for detection and research. You may also wish to archive the logs to a cheaper storage service rather than simply deleting them. See the following AWS resource to manage CloudWatch Logs retention periods:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Perform the following to determine if VPC Flow logs is enabled:
From Console:

Sign into the management console

Select Services then VPC

In the left navigation pane, select Your VPCs

Select a VPC

In the right pane, select the Flow Logs tab.

If no Flow Log exists, click Create Flow Log

For Filter, select Reject

Enter in a Role and Destination Log Group

Click Create Log Flow

Click on CloudWatch Logs Group

Note: Setting the filter to 'Reject' will dramatically reduce the logging data accumulation for this recommendation and provide sufficient information for the purposes of breach detection, research and remediation. However, during periods of least privilege security group engineering, setting this the filter to 'All' can be very helpful in discovering existing traffic flows required for proper operation of an already running environment.

See Also

https://workbench.cisecurity.org/files/3416

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-2, 800-53|AU-12, 800-53|SI-4, 800-53|SI-5, CSCv6|6.2, CSCv6|12.5, CSCv7|6.2, CSCv7|12.5

Plugin: amazon_aws

Control ID: 46725a513eab3cf0e53cc29f95eb86f944444b8407c4010610b346bca48639f9