id: vpc-flowlogs-not-enabled
info:
  name: VPC Flow Logs Not Enabled
  author: princechaddha
  severity: low
  description: |
    Ensures Amazon VPC Flow Logs are enabled for tracking network traffic to and from VPCs, aiding in security and troubleshooting.
  impact: |
    Without VPC Flow Logs, detecting abnormal traffic patterns or breaches becomes difficult, increasing risk of undetected threats.
  remediation: |
    Enable VPC Flow Logs in the AWS Management Console under the VPC dashboard to collect data on IP traffic going to and from network interfaces in your VPC.
  reference:
    - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
  tags: cloud,devops,aws,amazon,vpc,aws-cloud-config

variables:
  region: "us-east-1"

flow: |
  code(1)
  for(let VpcIds of iterate(template.VpcId)){
    set("vpc", VpcIds)
    code(2)
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      aws ec2 describe-vpcs --region $region --query 'Vpcs[*].VpcId' --output json

    extractors:
      - type: json
        name: VpcId
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
         aws ec2 describe-flow-logs --region $region --filter "Name=resource-id,Values=$vpc"

    matchers:
      - type: word
        words:
          - "[]"
        condition: and


    extractors:
      - type: dsl
        dsl:
          - '"Flow Logs feature is not enabled for the VPC " + vpc'
# digest: 4a0a00473045022016d83c316f318298be2c514542422c1a2f3a42517ac740d4b85ca980c9bf4676022100e7af7b416817f374b418962094ee777893f8fed6b17880fea736d1eb6caa38b2:922c64590222798bb761d5b6d8e72950