---
title: VPC flow logging should be enabled in all VPCs
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > VPC flow logging should be enabled in
  all VPCs
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# VPC flow logging should be enabled in all VPCs
 
## Description{% #description %}

AWS VPCs should have at least one VPC Flow Log with an Active status. VPC Flow Logs capture information about the IP traffic to and from network interfaces in your VPCs, providing visibility into rejected traffic and helping detect anomalous activity during breach investigations. This rule fails any VPC that has no flow log, or whose flow logs are not active.

## Remediation{% #remediation %}

1. In the [Amazon VPC console](https://console.aws.amazon.com/vpc/), select the VPC, open the **Flow Logs** tab, and if no active flow log exists, click **Create flow log** (a **Reject** filter is sufficient for breach detection) with a destination log group and IAM role.
1. Alternatively, run `aws ec2 create-flow-logs --resource-type VPC --resource-ids <vpc-id> --traffic-type REJECT --log-group-name <log-group-name> --deliver-logs-permission-arn <iam-role-arn>` for each VPC in every region, as described in [Create a flow log](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-flow-logs.html).

## References{% #references %}

- [Logging IP traffic using VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html)
- [Create a flow log](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-flow-logs.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)