Enable VPC flow logs in every VPC

A VPC is AWS's private network — it's the envelope that contains every compute resource, database, and service a workload runs on. VPC flow logs are the network-level record of what talked to what inside that envelope: source IP, destination IP, ports, protocol, whether the traffic was allowed or blocked, and how much data moved. They do not capture the content of traffic, only the connection metadata. Security Hub control EC2.6 flags every VPC that has no active flow log — meaning no network audit trail at all.

From a cost-ownership perspective, flow logs are an operating cost with a known price structure. Sending logs to S3 with a ten-minute aggregation window runs roughly $50–$200 per month per busy VPC; a quieter environment VPC is considerably less. CloudWatch Logs costs more per GB but enables real-time alerting. The right model is to budget at the environment tier: a cheap S3 destination for all VPCs as the baseline audit trail, CloudWatch Logs added only for production VPCs where real-time incident detection has clear value.

The financial risk of not having flow logs is asymmetric and hard to cap. A breach response without network visibility costs six to seven figures in forensic-consultant time — and may still not answer the regulator's question. PCI DSS, SOC 2, ISO 27001, and HIPAA all require network access logging; a missing flow log on a VPC that touches in-scope data is a direct audit finding. The Security Hub EC2.6 flag is not a discretionary cost; for regulated environments it is a compliance obligation with a known, modest price tag.

Dana is the finance partner for the same fintech. When the Security Hub report lands showing 23 VPCs with no flow logs, her first question is not 'how much does it cost to turn them on?' It's 'what are these 23 VPCs, and which ones are in scope for our PCI DSS audit next quarter?'

The team quickly categorises the VPCs: seven are production environments that handle card data and are directly in compliance scope; twelve are staging and development; four are legacy test environments nobody remembers creating. Dana agrees the production seven need S3 flow logs immediately — the PCI auditor will ask for six months of network logs and there are only six weeks until the audit. She budgets roughly $800/month for S3 ingestion and storage across the seven, which she frames as a known audit-preparation cost, not a discretionary security ask.

For the twelve staging VPCs she and the engineering lead agree on a lighter baseline: S3 logs enabled to satisfy EC2.6, but no CloudWatch Logs overlay, and the 600-second aggregation interval to keep volume — and cost — down. The four legacy environments are scheduled for deletion; in the meantime they get minimal S3 logs just to clear the finding. Dana's summary for the next finance review: 'Network audit trail now covers 100% of VPCs; production logging costs $800/month, a planned line against compliance readiness.'

The unit economics of flow logs are straightforward. S3 storage at $0.023/GB/month, plus data ingestion, plus occasional Athena query costs: a typical busy production VPC runs $50–$200/month all-in with a 600-second aggregation interval and ALL traffic. A lighter environment VPC with REJECT-only filtering can run under $20/month. These are predictable, budgetable line items tied to network volume — not open-ended variable costs.

Against that, model the uninsured exposure. A breach investigation without network visibility typically requires a specialist forensic firm at $300–$500/hour for several weeks — often $150,000 to $500,000 in incident-response cost alone, before legal fees, customer notification, and regulatory response. And that's with a cooperative outcome. An audit finding for a missing network log under PCI DSS or HIPAA can trigger remediation mandates, fines, and elevated future scrutiny that dwarf the logging cost.

From a budget governance perspective, the right framing is: flow logs are a compliance infrastructure cost that should be a standing line in the cloud budget, tiered by environment. Production VPCs get full ALL-traffic S3 logging as a baseline; lower environments get the cheaper REJECT-only or a smaller aggregation window. That keeps the spend proportionate while ensuring every VPC in regulatory scope has a defensible audit trail.

The finance sign-off question for any exception — a VPC without flow logs — should be: 'Is this VPC outside all regulatory scope, and do we have written documentation of that decision?' If the answer is anything other than a clean yes, the logging cost is cheaper than the alternative.

Every cloud workload runs inside a virtual network called a VPC. By default, AWS records nothing about who connected to what inside that network. VPC flow logs change that: once enabled, AWS logs every network conversation — what talked to what, when, and whether it was allowed or blocked. Security Hub EC2.6 flags every VPC that is running without this logging.

The executive question this control answers is straightforward: if a breach or data-access incident occurs, can we reconstruct what happened on the network and tell a regulator or auditor who accessed what? Without flow logs the answer is no — and that gap shows up directly in PCI DSS, SOC 2, ISO 27001, and HIPAA audits. The cost is small and predictable; the exposure for not having it is not. A clean EC2.6 posture means every network segment has a logged audit trail by policy, not by luck.

Before the fintech addressed EC2.6, the CISO's honest answer to 'could we reconstruct a network breach?' was 'probably not.' No flow logs meant no audit trail. When the board asked about the upcoming PCI audit, the answer was uncomfortable.

After the remediation, the picture changed. Every production VPC logs all network flows to S3, with six months of retention. The security team can answer a forensic question — 'which other instances did that compromised host communicate with?' — in minutes using Athena. The PCI auditor got the network log evidence they asked for without escalation.

The governance change that made it stick was simple: a Config rule now fires within minutes if any new VPC ships without a flow log. The result is that 'do we have network visibility?' stopped being a question the organisation had to investigate and became a standing yes. That's the right end state — network logging as a default, governed by policy, not as a reaction to a finding or an audit.

The core risk from missing flow logs is not operational — it's accountability. When a breach or data-access incident occurs, the first question from a regulator, a board, or a cyber-insurance underwriter is 'what did the attacker access, and how do you know?' Without network flow logs, the honest answer is 'we don't know.' That answer is not acceptable to PCI DSS, SOC 2, ISO 27001, or HIPAA auditors, and it substantially weakens any insurance claim.

The practical consequence is that a breach without network visibility is always worse than a breach with it. The remediation scope becomes 'assume everything was touched' rather than 'here is exactly what was accessed.' The regulatory response is harder to bound. The customer notification obligation is broader. And the forensic bill is much larger.

This is why EC2.6 sits on the leadership risk register rather than the engineering backlog. The decision to enable flow logs is not a technical one — it's a risk-tolerance decision about whether the organisation can answer the accountability question if something goes wrong. A clean EC2.6 posture means the answer is yes, by design.