Implement VPC flow logs for Transit Gateway

[dms1981]

User Story

As a Modernisation Platform Engineer I want to implement Transit Gateway flow logs So that I have access to logging data when investigation traffic flows in and out of the Modernisation Platform

User Type(s)

Modernisation Platform Engineer Modernisation Platform Customer

Value

By implementing AWS Transit Gateway flow logs we can confirm the passage of traffic through our Transit Gateway. We can correlate this information with our existing VPC flow logs should we need to investigate questions around network flow.

Questions / Assumptions / Hypothesis

Proposal

In situations where our routing is correctly configured we're unlikely to have problems with networking. However, as we expand our configuration of the AWS Network Firewall and move to a security posture where traffic is only permitted by design, we may find ourselves wanting to investigate traffic flows in more detail.

Definition of done

• [ ] transit gateway flow logs configured
• [ ] relevant documentation updated
• [ ] another team member has reviewed

Reference

How to write good user stories Logging network traffic using Transit Gateway Flor Logs

[dms1981]

NB. In order to accurately gauge which traffic is passing through without matching a rule, it is strongly suggested that - at first - we have an open rule at the end of the rulebase with an alert action. This will have the effect of allowing traffic to pass, while also logging these exceptions to our rules.

• https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html#:~:text=Alert%20logs%20report%20traffic%20that%20matches%20your%20stateful%20rules%20that%20have%20an%20action%20that%20sends%20an%20alert.%20A%20stateful%20rule%20sends%20alerts%20for%20the%20rule%20actions%20DROP%20and%20ALERT.

[markgov]

inital code writen and pr created to capture that code

[markgov]

Code Created and tested via a plan 46 flow logs would be created pr up for review

[markgov]

code updated to encrypt the log files and to pull the attachments id's down into a data block

[markgov]

flow logs implemented