OCI Network VCN Flow Logs Should Be Enabled

More Info:

VCN Flow Logs should be enabled for all Virtual Cloud Networks. Flow logs provide visibility into network traffic patterns and are essential for detecting lateral movement and data exfiltration.

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS AWS
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• GDPR
• HIPAA
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Use the VCN’s built‑in Flow Logs feature and send them to the OCI Logging service. Steps below are all in the OCI Console.

Prerequisites

• You have permissions to manage VCNs and Logging in the target compartment.
• (Recommended) Decide which VCNs/subnets you want logs for and a naming convention for log groups.

---

1. Create (or choose) a Log Group

1. In the OCI Console, open the Navigation menu.
2. Go to Observability & Management → Logging → Log Groups.
3. Select the Compartment where your VCN resides.
4. Click Create Log Group (or choose an existing one).
5. Enter a Name and Description, then click Create.

---

2. Enable Flow Logs on the VCN (recommended: at subnet level)

1. Open the Navigation menu → Networking → Virtual Cloud Networks.
2. Select the correct Compartment, then click your VCN.
3. Under Resources, click Flow Logs.
4. Click Create Flow Log.
5. Configure:
   • Flow Log Name: e.g., vcn1-subnetA-flows.
   • Target:
     • Log Group: select the log group from step 1.
     • Log Name: e.g., vcn1-subnetA-flow-log.
   • Scope Type:
     • Choose Subnet (or VCN) depending on your policy.
   • Scope:
     • If Subnet: select the specific subnet(s) whose traffic you want to log.
   • Traffic Type: choose All, or restrict to Ingress/Egress per requirements.
   • Aggregation Interval / Log Format: leave defaults unless you have specific requirements.
6. Click Create Flow Log.

Repeat for each VCN/subnet that must have flow logs enabled to satisfy the control.

---

3. Verify Logs Are Being Collected

1. Go to Observability & Management → Logging → Logs.
2. Select the Compartment and Log Group you used.
3. Click the flow log you created.
4. Check the Log entries tab to confirm new records are appearing (may take a few minutes).

Once each required VCN (or its subnets) has an active Flow Log resource writing to a Log Group, the “OCI Network VCN Flow Logs Should Be Enabled” requirement is remediated for OCI Networking Monitoring.

Using CLI

Below is a practical, CLI‑focused way to enable VCN Flow Logs for OCI Networking Monitoring.

High‑level steps

1. Decide:

   • Which compartment you will use for logs
   • Which VCN/subnet(s) you want flow logs for
   • Which log group to place them in
   • Which log retention you want (days)

2. Using OCI CLI:

   • Create (or reuse) a Log Group
   • Create a Flow Log on the target subnet(s) or VCN

---

0. Prerequisites

• OCI CLI installed and configured (oci setup config)
• Your user/instance principal has:
  • logging-family permissions on the target compartment
  • inspect virtual-network-family at least

Example IAM policy (adjust compartment/subject as needed):

Allow group NetworkAdmins to manage log-groups in compartment Network-Logs
Allow group NetworkAdmins to manage logs in compartment Network-Logs
Allow group NetworkAdmins to read virtual-network-family in compartment Network

---

1. Identify target resources

Compartment

export COMP_OCID="<compartment_ocid_for_logs>"

Subnet or VCN OCID (usually you configure flow logs at subnet level):

# List subnets and find the right one
oci network subnet list --compartment-id $COMP_OCID --all

# Then export the chosen subnet OCID:
export SUBNET_OCID="<target_subnet_ocid>"

(If you want VCN‑level logs, identify the VCN OCID similarly with oci network vcn list --compartment-id $COMP_OCID.)

---

2. Create (or reuse) a Log Group

If you already have a log group for network logs, skip to step 3.

oci logging log-group create \
  --compartment-id $COMP_OCID \
  --display-name "network-flow-logs" \
  --wait-for-state ACTIVE

Capture the Log Group OCID:

export LOG_GROUP_OCID=$(oci logging log-group list \
  --compartment-id $COMP_OCID \
  --display-name "network-flow-logs" \
  --all \
  --query 'data[0].id' \
  --raw-output)

---

3. Create a VCN Flow Log (subnet source) using CLI

Flow logs are service logs in the Logging service with source flowlogs and the resource set to your subnet (or VCN) OCID.

Basic example (subnet):

oci logging log create \
  --log-group-id $LOG_GROUP_OCID \
  --display-name "subnet-${SUBNET_OCID##*.}-flow-log" \
  --log-type SERVICE \
  --is-enabled true \
  --configuration '{
    "source": {
      "category": "all",
      "resource": "'"$SUBNET_OCID"'",
      "service": "flowlogs",
      "sourceType": "OCISERVICE"
    }
  }' \
  --retention-duration 30 \
  --wait-for-state ACTIVE

Key parts:

• --log-type SERVICE – this is a service log
• service: "flowlogs" – the VCN Flow Logs service
• resource: "<subnet_ocid>" – subnet being logged
• category: "all" – all flow log records
• --retention-duration 30 – days (change as required)

To log at VCN level, set "resource": "<vcn_ocid>" instead of subnet OCID.

---

4. Verify the log is active

oci logging log list \
  --log-group-id $LOG_GROUP_OCID \
  --all \
  --query 'data[].{"Name": "display-name", "OCID": "id", "Enabled": "is-enabled"}'

---

5. (Optional) Enable flow logs for multiple subnets

Example loop over all subnets in a VCN:

export VCN_OCID="<your_vcn_ocid>"

for SUBNET_OCID in $(oci network subnet list \
    --compartment-id $COMP_OCID \
    --vcn-id $VCN_OCID \
    --query 'data[].id' \
    --raw-output); do

  oci logging log create \
    --log-group-id $LOG_GROUP_OCID \
    --display-name "subnet-${SUBNET_OCID##*.}-flow-log" \
    --log-type SERVICE \
    --is-enabled true \
    --configuration '{
      "source": {
        "category": "all",
        "resource": "'"$SUBNET_OCID"'",
        "service": "flowlogs",
        "sourceType": "OCISERVICE"
      }
    }' \
    --retention-duration 30 \
    --wait-for-state ACTIVE

done

---

If you share:

• compartment OCID
• whether you want subnet‑ or VCN‑level logs
  I can tailor an exact CLI script for your environment.

Using Python

Below is how to enable VCN Flow Logs in OCI using Python (OCI Python SDK), step by step.

---

1. Prerequisites

1. Python SDK installed

pip install oci

2. Configured OCI CLI/SDK config

~/.oci/config should have at least:

[DEFAULT]
user=ocid1.user.oc1..aaaa...
fingerprint=...
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..aaaa...
region=us-ashburn-1

3. IAM Policy

Your user/group must have permissions like:

allow group <group-name> to manage virtual-network-family in tenancy
allow group <group-name> to manage log-groups in tenancy
allow group <group-name> to manage logs in tenancy

---

2. Decide Scope and Resources

You need:

• VCN OCID – the network you want to capture flow logs for
• Subnet OCID(s) – if logging at subnet level
• Compartment OCID – where the VCN resides
• Log Group – where flow logs will be stored (create one if needed)

You can create either:

• A VCN-level flow log (captures flows for the whole VCN), or
• Subnet-level flow logs (per subnet).

Below examples show both.

---

3. Create (or Use) a Log Group

import oci

config = oci.config.from_file()  # default profile
identity_client = oci.identity.IdentityClient(config)
logging_mgmt_client = oci.logging.LoggingManagementClient(config)

compartment_id = "<COMPARTMENT_OCID>"

# 1) Check if a suitable log group already exists (optional)
existing_groups = logging_mgmt_client.list_log_groups(
    compartment_id=compartment_id
).data

log_group_name = "vcn-flow-logs-group"
log_group_id = None
for g in existing_groups:
    if g.display_name == log_group_name:
        log_group_id = g.id
        break

# 2) Create log group if not found
if not log_group_id:
    create_lg_details = oci.logging.models.CreateLogGroupDetails(
        compartment_id=compartment_id,
        display_name=log_group_name,
        description="Log group for VCN Flow Logs"
    )
    lg_resp = logging_mgmt_client.create_log_group(create_lg_details)
    log_group_id = lg_resp.data.id

print("Using log group:", log_group_id)

---

4. Enable VCN-Level Flow Logs

from oci.logging.models import CreateLogDetails, LogConfiguration, UnifiedAgentConfiguration

vcn_id = "<VCN_OCID>"

# Create a VCN Flow Log
create_log_details = CreateLogDetails(
    display_name="vcn-flow-log",
    log_group_id=log_group_id,
    log_type="SERVICE",          # required for service (flow) logs
    is_enabled=True,
    configuration=LogConfiguration(
        source=oci.logging.models.OciServiceVcnFlowLogSource(
            service="vcnflowlogs",    # fixed
            resource=vcn_id,          # VCN OCID
            category="all"            # "all" to capture all flows
        )
    )
)

log_resp = logging_mgmt_client.create_log(create_log_details)
vcn_flow_log_id = log_resp.data.id
print("VCN Flow Log created:", vcn_flow_log_id)

This will enable flow logs for all traffic in the VCN and send them to the log group.

---

5. Enable Subnet-Level Flow Logs (Optional, Per Subnet)

subnet_id = "<SUBNET_OCID>"

create_log_details_subnet = CreateLogDetails(
    display_name="subnet-flow-log",
    log_group_id=log_group_id,
    log_type="SERVICE",
    is_enabled=True,
    configuration=LogConfiguration(
        source=oci.logging.models.OciServiceVcnFlowLogSource(
            service="vcnflowlogs",
            resource=subnet_id,  # SUBNET OCID
            category="all"
        )
    )
)

subnet_log_resp = logging_mgmt_client.create_log(create_log_details_subnet)
subnet_flow_log_id = subnet_log_resp.data.id
print("Subnet Flow Log created:", subnet_flow_log_id)

---

6. Verify Logs Are Enabled

You can list logs in the log group:

logs = logging_mgmt_client.list_logs(
    log_group_id=log_group_id
).data

for log in logs:
    print(log.display_name, log.id, "enabled:", log.is_enabled)

You should see your vcn-flow-log (and/or subnet-flow-log) with is_enabled=True.

---

If you share your tenancy/compartment structure and whether you want logs at VCN level only or also per subnet, I can tailor the Python snippet to your exact layout (e.g., looping through all VCNs/subnets in a compartment).

Using Terraform

resource "oci_core_vcn" "this" {
  # Replace with your VCN config
  compartment_id = VAR_COMPARTMENT_OCID   # set to the OCID of the compartment
  cidr_block     = "10.0.0.0/16"
  display_name   = "VCN_WITH_FLOW_LOGS"
  dns_label      = "vcnflow"
}

resource "oci_logging_log_group" "vcn_flow_logs" {
  compartment_id = VAR_COMPARTMENT_OCID   # same compartment as the VCN (or where you want logs)
  display_name   = "VCN_Flow_Logs_Group"
}

resource "oci_logging_log" "vcn_flow_logs" {
  log_group_id = oci_logging_log_group.vcn_flow_logs.id

  display_name = "VCN_Flow_Logs_${oci_core_vcn.this.display_name}"
  is_enabled   = true            # THIS enables VCN Flow Logs

  log_type = "SERVICE"

  configuration {
    source {
      category       = "all"          # capture all flow log categories
      resource       = oci_core_vcn.this.id
      service        = "flowlogs"     # OCI networking flow logs service
      source_type    = "OCID"
    }
  }
}

This does not replace the existing VCN; it only creates logging resources that attach to it.

To verify, terraform plan should show:

• 1 new oci_logging_log_group
• 1 new oci_logging_log with is_enabled = true and service = "flowlogs" referencing the VCN OCID.