Panther medium experimental python

AWS VPC Flow Logs

This policy validates that AWS VPCs (Virtual Private Clouds) have network flow logging enabled.

View Source

Detection Logic

def policy(resource):
    if resource["FlowLogs"] is None:
        return False

    for flow in resource["FlowLogs"]:
        if flow["FlowLogStatus"] == "ACTIVE" and (
            flow["TrafficType"] == "REJECT" or flow["TrafficType"] == "ALL"
        ):
            return True

    return False

Field Validations

Loading…

Comments (0)

Loading comments...