Skip to main content

🛡️ Google GCE Subnetwork Flow Logs are not enabled🟢

Stats​

not available

Logic​

Similar Policies​

Description​

Open File

Description​

This policy checks whether VPC Flow Logs are enabled and configured correctly for Google Cloud GCE subnetworks that support flow logging. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a subnet and make that data available in Cloud Logging.

Rationale​

VPC Flow Logs provide visibility into network traffic for resources inside a subnet. They support network monitoring, traffic analysis, network forensics, and security investigations. Logging all traffic with detailed intervals, complete metadata, full sampling, and no filter helps preserve the context needed to investigate suspicious or unexpected activity.

Impact​

Enabling VPC Flow Logs can increase Cloud Logging, BigQuery, or Pub/Sub costs depending on the configured sinks and retained log volume.

Audit​

This policy flags a Google GCE Subnetwork as INCOMPLIANT when its Purpose is PRIVATE and any of the following conditions are met:

  • Flow Logs is not set to Enabled.
  • Log Config State is not set to Enabled.

... see more

Remediation​

Open File

Remediation​

From Google Cloud Console​

  1. Go to the VPC network GCP Console visiting https://console.cloud.google.com/networking/networks/list
  2. Click the name of a subnet, The Subnet details page displays.
  3. Click the EDIT button.
  4. Set Flow Logs to On.
  5. Expand the Configure Logs section.
  6. Set Aggregation Interval to 5 SEC.
  7. Check the box beside Include metadata.
  8. Set Sample rate to 100.
  9. Click Save.
Note​

It is not possible to configure a Log filter from the console.

From Google Cloud CLI​

To enable VPC Flow Logs for a network subnet, run the following command:

gcloud compute networks subnets update {{subnet-name}} \
    --region {{region}} \
    --enable-flow-logs \
    --logging-aggregation-interval=interval-5-sec \
    --logging-flow-sampling=1 \
    --logging-metadata=include-all

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS GCP v1.2.0 → 💼 3.8 Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network - Level 1 (Automated)1no data
💼 CIS GCP v1.3.0 → 💼 3.8 Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network - Level 1 (Automated)1no data
💼 CIS GCP v2.0.0 → 💼 3.8 Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network - Level 2 (Automated)1no data
💼 CIS GCP v3.0.0 → 💼 3.8 Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network - Level 2 (Automated)1no data
💼 CIS GCP v4.0.0 → 💼 3.8 Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network - Level 2 (Automated)1no data
💼 CIS GCP v5.0.0 → 💼 3.10 Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network - Level 2 (Automated)1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration79no data
💼 FedRAMP High Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)145365no data
💼 FedRAMP Low Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)11no data
💼 FedRAMP Moderate Security Controls → 💼 SI-4 System Monitoring (L)(M)(H)715no data
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging2035no data
💼 ISO/IEC 27001:2022 → 💼 8.16 Monitoring activities519no data
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events2165no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities53no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources68no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events187no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events53no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations47no data
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties63no data
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities63no data
💼 NIST CSF v2.0 → 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded48no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected248no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected219no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected249no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-4 System Monitoring25118no data
💼 SOC 2 → 💼 CC7.2-1 Implements Detection Policies, Procedures, and Tools7no data
💼 SOC 2 → 💼 CC7.2-2 Designs Detection Measures7no data
💼 SOC 2 → 💼 CC7.2-3 Implements Filters to Analyze Anomalies918no data
💼 SOC 2 → 💼 CC7.2-4 Monitors Detection Tools for Effective Operation1no data