Ensure Flow Logs are enabled for every VPC

MoyenneNiveau 2Automatiséeibmcloud

Description

Flow logs capture network traffic metadata for monitoring and investigations. In the targeted region every VPC must be referenced by at least one flow log collector (VPC- or subnet/instance-level). Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

Méthode de vérification

Méthode d'audit: Commande shell

shell

vpcs=$(ibmcloud is vpcs --output json 2>/dev/null) || exit 1
fl=$(ibmcloud is flow-logs --output json 2>/dev/null) || exit 1
bad=0
for v in $(printf '%s\n' "$vpcs" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 1 && /"id"[[:space:]]*:/ { s = $0; sub(/^[^:]*:[[:space:]]*"/, "", s); sub(/".*/, "", s); print s } { d += o - c }'); do
  printf '%s\n' "$fl" | grep -qF "\"$v\"" || { echo "no flow log: $v"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

ibmcloud is flow-log-create --bucket <cos-bucket> --target <vpc-id> --name <name> --active true for each listed VPC (requires a COS service-to-service authorisation).

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: ibmcloudlogging
Référence: CIS IBM Cloud Foundations Benchmark v2.0.0 - Logging and Monitoring - VPC flow logs enabled (verify section number for your release)

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target ibmcloud --level 2