AWS VPC Flow Logs

​

Overview

VPC Flow Logs record metadata about every accepted or rejected IP packet across:

• VPC, subnet, and ENI (network interface) traffic
• Source and destination IPs, ports, protocol, and bytes
• Action (ACCEPT / REJECT) and security group decision

Atatus reads VPC flow logs that have been delivered to a CloudWatch log group.

---

​

Prerequisites

• A VPC with flow logging enabled and configured to deliver to CloudWatch Logs.
• IAM credentials with read access to that log group.

---

​

Step 1: Enable VPC Flow Logs (if not already)

1. Open the AWS Console → VPC.
2. Select the VPC, subnet, or ENI to monitor and choose Flow logs → Create flow log.
3. Configure:
   • Filter: All (recommended) or Reject/Accept.
   • Destination: Send to CloudWatch Logs.
   • Log group: select an existing group or create one (for example, vpc-flow-logs-group).
   • IAM role: the role that allows VPC to publish to CloudWatch Logs.
4. Click Create flow log.

---

​

Step 2: Create an IAM user with log read access

1. Open IAM → Users → Create user, name it atatus-vpc-flow-reader.
2. Attach an inline policy granting:
   • logs:DescribeLogGroups
   • logs:DescribeLogStreams
   • logs:GetLogEvents
   • logs:FilterLogEvents
3. Scope the policy to the flow logs log group ARN.
4. Create an access key under Security credentials → Create access key and copy both values.

---

​

Step 3: Connect AWS VPC Flow Logs in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the AWS VPC Flow Logs card and click Connect.
3. Fill in the form:

4. Click Connect.

---

​

Verification

• The AWS VPC Flow Logs card shows Configured.
• Flow records appear in Security → Cloud SIEM → Audit Logs → Events with source aws_vpc_flow_logs.