EC2.6: No VPC flow logs, so there is no network audit trail

What does AWS Security Hub EC2.6 check?

EC2.6 sweeps every VPC in every region and fails any that has no active flow log resource attached. Flow logs are off by default, so a freshly created VPC fails the control until someone explicitly enables logging to CloudWatch Logs, S3, or Kinesis Firehose.

Why does EC2.6 matter?

Without flow logs you have no network audit trail. When GuardDuty fires or a credential leaks, the investigation needs to know which hosts the attacker touched and how much data moved, and AWS does not retroactively reconstruct flows you never captured. PCI DSS Req 10, SOC 2 CC7.2, ISO 27001, and HIPAA all expect network access to be logged.

How do I fix EC2.6?

1. Inventory every VPC in every enabled region and cross-reference describe-flow-logs to find the ones with no coverage, including default VPCs.
2. Pick a destination per environment: S3 with a 600s aggregation interval for the cheap audit trail, CloudWatch Logs on production for real-time queries.
3. Bulk-enable with create-flow-logs in an idempotent loop, using traffic-type ALL for full forensic visibility.
4. Add the AWS Config rule vpc-flow-logs-enabled so any new VPC without a flow log is flagged within minutes.

# Bulk-enable VPC flow logs to S3 across every region, skipping VPCs that already have one.
BUCKET_ARN="arn:aws:s3:::acme-flow-logs"

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  for vpc in $(aws ec2 describe-vpcs --region $region --query 'Vpcs[].VpcId' --output text); do
    existing=$(aws ec2 describe-flow-logs --region $region \
      --filter Name=resource-id,Values=$vpc \
      --query 'length(FlowLogs)' --output text)
    if [ "$existing" = "0" ]; then
      echo "[$region] enabling flow log on $vpc"
      aws ec2 create-flow-logs --region $region \
        --resource-type VPC --resource-ids $vpc \
        --traffic-type ALL \
        --log-destination-type s3 \
        --log-destination $BUCKET_ARN/$region/ \
        --max-aggregation-interval 600
    fi
  done
done