VPC Flow Logs to CloudWatch

📦 Overview

This Terraform module provisions VPC Flow Logs that capture and send network traffic metadata to an Amazon CloudWatch Log Group for real-time observability and security analysis.

---

✅ Key Features

• Logs accepted, rejected, or all traffic from a specified VPC
• Sends logs to CloudWatch Logs for immediate visibility
• Supports tagging for environment-level traceability
• Attaches IAM role for logging permissions

---

💼 Use Cases

• Real-time network monitoring for production environments
• Security auditing and compliance reviews
• Forensic analysis of network activity post-incident
• Integration with CloudWatch Insights or external SIEM platforms

---

📥 Input Variables

Name	Type	Description
region	string	AWS region for the deployment
vpc_id	string	VPC ID to enable flow logs on
log_group_name	string	Name of the CloudWatch Log Group for log delivery
iam_role_arn	string	ARN of the IAM role with CloudWatch logging permissions
traffic_type	string	Type of traffic to log: ACCEPT, REJECT, or ALL
environment	string	Environment tag (e.g., dev, staging, prod) for visibility and filtering

---

📤 Outputs

Name	Description
flow_log_id	The ID of the created VPC Flow Log
log_group_name	The CloudWatch Log Group receiving the logs

---

🚀 Deployment Readiness

• ✅ Compatible with Terraform 1.0+
• ✅ Requires AWS Provider 5.x+
• 🔐 IAM role must include logs:PutLogEvents, logs:CreateLogStream
• 📋 Log group must exist or be created via Terraform if permitted

---

🛠️ Example Usage

module "flow_logs_vpc_deployment" {
  source = "git::ssh://git@github.com/archiphire/aws-level-1-modules.git//logging/flow-logs-vpc?ref=v1.0.0"

  region          = "us-east-1"
  vpc_id          = "vpc-0123456789abcdef0"
  log_group_name  = "/aws/vpc/flowlogs"
  iam_role_arn    = "arn:aws:iam::123456789012:role/FlowLogsRole"
  traffic_type    = "ALL"
  environment     = "prod"
}

terraform init
terraform plan
terraform apply

or

tofu init
tofu plan
tofu apply

🧹 Cleanup Options

Terraform Destroy:

terraform destroy

or

tofu destroy

Manual Deletion (Recommended for Production):

aws ec2 delete-flow-logs --flow-log-ids <flow-log-id>

🛡️ Notes

This is a Level 1 logging module intended for VPC traffic visibility via CloudWatch. To store logs long-term or offload for compliance, consider using the flow-logs-s3 variant.

🔒 Deployment Package Notice

This module is part of the Level 1 AWS License Tier. To access the full deployment package and source code, subscribe to Archiphire.