Ensure Flow Logs are enabled for every VPC

OrtaDüzey 2Otomatikibmcloud

Açıklama

Flow logs capture network traffic metadata for monitoring and investigations. In the targeted region every VPC must be referenced by at least one flow log collector (VPC- or subnet/instance-level). Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

vpcs=$(ibmcloud is vpcs --output json 2>/dev/null) || exit 1
fl=$(ibmcloud is flow-logs --output json 2>/dev/null) || exit 1
bad=0
for v in $(printf '%s\n' "$vpcs" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 1 && /"id"[[:space:]]*:/ { s = $0; sub(/^[^:]*:[[:space:]]*"/, "", s); sub(/".*/, "", s); print s } { d += o - c }'); do
  printf '%s\n' "$fl" | grep -qF "\"$v\"" || { echo "no flow log: $v"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

ibmcloud is flow-log-create --bucket <cos-bucket> --target <vpc-id> --name <name> --active true for each listed VPC (requires a COS service-to-service authorisation).

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: ibmcloudlogging
Referans: CIS IBM Cloud Foundations Benchmark v2.0.0 - Logging and Monitoring - VPC flow logs enabled (verify section number for your release)

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target ibmcloud --level 2