Ensure Flow Logs are enabled for every VPC

SrednjaNivo 2Automatskaibmcloud

Opis

Flow logs capture network traffic metadata for monitoring and investigations. In the targeted region every VPC must be referenced by at least one flow log collector (VPC- or subnet/instance-level). Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

Kako se proverava

Metod provere: Komanda ljuske

shell

vpcs=$(ibmcloud is vpcs --output json 2>/dev/null) || exit 1
fl=$(ibmcloud is flow-logs --output json 2>/dev/null) || exit 1
bad=0
for v in $(printf '%s\n' "$vpcs" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 1 && /"id"[[:space:]]*:/ { s = $0; sub(/^[^:]*:[[:space:]]*"/, "", s); sub(/".*/, "", s); print s } { d += o - c }'); do
  printf '%s\n' "$fl" | grep -qF "\"$v\"" || { echo "no flow log: $v"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

ibmcloud is flow-log-create --bucket <cos-bucket> --target <vpc-id> --name <name> --active true for each listed VPC (requires a COS service-to-service authorisation).

Svojstva

Operativni sistemi: Bilo koji
Oznake: ibmcloudlogging
Referenca: CIS IBM Cloud Foundations Benchmark v2.0.0 - Logging and Monitoring - VPC flow logs enabled (verify section number for your release)

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target ibmcloud --level 2