Configuring and using VPC flow logs

In this recipe, we will enable flow logs at the VPC level.

Getting ready

We need the following resources for completing the steps within this recipe:

• A CloudWatch log group will be needed. The detailed steps are provided later in this section.
• We need to set up a VPC. If one hasn’t been created previously, please refer to the Creating a bare VPC and setting up public and private subnets recipe.
• An IAM role with permissions to publish to the CloudWatch log group with full access will also be needed.

We can perform the following steps to create a CloudWatch log group:

1. Go to the CloudWatch service in the AWS console.
2. Click on Logs from the left sidebar.
3. Click on Log groups and click on Create log group.
4. Give the log group a name that describes its purpose, keep the other values as their defaults, and click on Create.

How to do it...

We can configure VPC flow logs from the console as follows...