DEV Community

Cover image for Enable Flow Logs for your VPC and collect all traffic in and out of your VPC network
Surya Shankar
Surya Shankar

Posted on

Enable Flow Logs for your VPC and collect all traffic in and out of your VPC network

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC.

Flow logs can help you with a number of tasks, such as:

  • Diagnosing overly restrictive security group rules
  • Monitoring the traffic that is reaching your instance
  • Determining the direction of the traffic to and from the network interfaces

Image description

Create your VPC , Subnet , InternetGateway & Routes table with Subnets Associations.

Create a VPC in Mumbai region.
VPC name :- VPC-Mumbai
Ipv4 CIDR :- 11.0.0.0/16
Image description
Create a public subnet inside that VPC
Subnet name :- Pub-subnet
AZ :- ap-south-1b
Ipv4 CIDR :- 11.0.1.0/24
Image description
Create a InternetGateway and attach it to your VPC
Image description
Create a route table for subnet association
Image description
Image description
Allow 0.0.0.0/0 inside route for internet access
Image description

Create a EC2 instance inside the public subnet

Deploy a Window server
Image description
Image description
Image description
Image description

Create IAM Role to allow Flow Logs to be sent to the CloudWatch Log Group

First, we need to create an IAM Role there allows the Flow Logs to send data into a CloudWatch Log Group, so go to IAM > Roles and click Create role.
Image description
Now select Custom trust policy under the Trusted entity type and add the vpc-flow-logs.amazonaws.com as a principal service.
Image description
You should click next until you hit the review pages where you name your new role with a name you easily can find, this role can be reused every time you need a flow log role to send logs into CloudWatch Log Group.
Image description
Image description
After you have created your role it can be found under your roles before we are finished with the role we need to attach an inline policy to it so click on your new role.
Image description
Click add permissions > create inline policy to start editing your policy for this role.
Copy the policy into the inline policy and click next
Image description
You need to give the inline policy a name before you are finished with creating this inline policy for the role.
Now your role should end up with your new policy attached to your role as you created it and your role is now ready for use.
Image description

Create a CloudWatch Logs group

Search for cloud watch and click on log groups
When you create the log group you need to change the retention settings to 3 months and give your log group a name, after that you can create your group.
Image description
Image description

Create Flow Logs for your VPC

To create a flow log you need to go for VPC and right-click on the VPC you want to create a flow log on, then click Create flow log.

Image description
You need a name for your flow log and select your CloudWatch Log Group and the IAM Role you created before, use the AWS default format for logging.
Image description
Image description
When you have created your flow log you can see it by clicking on your VPC and going to Flow logs, here you can click on your destination name to visit the logs for this flow log.
Image description
Now you can see the log stream for each network eni-* click on the log stream you want to watch out for , Here No logs are there because nothing happended inside our network till now.
Image description
Now lets try to RDP inside the window server that we created earlier.
Image description
Image description
Image description
Now Go to log groups --> log streams
Image description
Here You can able to watch all the logs
Each group will contain a separate stream for each Elastic Network Interface (ENI):
Image description
Each stream, in turn, contains a series of flow log records.

Top comments (0)