vpc-flowlogs-not-enabled: VPC Flow Logs Not Enabled

id: vpc-flowlogs-not-enabled
info:
  name: VPC Flow Logs Not Enabled
  author: princechaddha
  severity: low
  description: |
    Ensures Amazon VPC Flow Logs are enabled for tracking network traffic to and from VPCs, aiding in security and troubleshooting.
  impact: |
    Without VPC Flow Logs, detecting abnormal traffic patterns or breaches becomes difficult, increasing risk of undetected threats.
  remediation: |
    Enable VPC Flow Logs in the AWS Management Console under the VPC dashboard to collect data on IP traffic going to and from network interfaces in your VPC.
  reference:
    - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
  metadata:
    max-request: 2
  tags: cloud,devops,aws,amazon,vpc,aws-cloud-config
variables:
  region: "us-east-1"

flow: |
  code(1)
  for(let VpcIds of iterate(template.VpcId)){
    set("vpc", VpcIds)
    code(2)
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      aws ec2 describe-vpcs --region $region --query 'Vpcs[*].VpcId' --output json

    extractors:
      - type: json
        name: VpcId
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
         aws ec2 describe-flow-logs --region $region --filter "Name=resource-id,Values=$vpc"

    matchers:
      - type: word
        words:
          - "[]"
        condition: and


    extractors:
      - type: dsl
        dsl:
          - '"Flow Logs feature is not enabled for the VPC " + vpc'
# digest: 4a0a004730450220705a6f82fc12aff1f8dec882596ee939a66cd28e670b1101e2928d36dd6affd1022100a15b552689f6ad866959316d7edd61a5df6df1718b6a4fab2113ca37363dee6e:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.