Find VPCs Without Flow Logs

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReportFlowLogCoverage",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVpcs",
        "ec2:DescribeFlowLogs",
        "ec2:DescribeSubnets",
        "ec2:DescribeNetworkInterfaces"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CreateS3FlowLogsOnlyWithApply",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateFlowLogs",
        "ec2:CreateTags",
        "logs:CreateLogDelivery",
        "logs:DeleteLogDelivery"
      ],
      "Resource": "*"
    }
  ]
}

// find-vpcs-without-flow-logs.ts
// Lists every VPC in the chosen Regions and reports whether it has an active VPC-level flow log,
// only subnet- or ENI-level flow logs ("partial"), a flow log whose delivery is failing, or nothing.
// Read-only by default. With --apply --bucket-arn it creates a VPC-level flow log to S3 for each VPC with none.
// Usage:
//   npx tsx find-vpcs-without-flow-logs.ts [--regions us-east-1,eu-west-1] [--csv vpc-flow-logs.csv]
//   npx tsx find-vpcs-without-flow-logs.ts --regions us-east-1 --bucket-arn arn:aws:s3:::acme-flow-logs-{region}/vpc/ [--traffic ALL] [--apply]
import { randomUUID } from "node:crypto";
import { writeFileSync } from "node:fs";
import {
  CreateFlowLogsCommand,
  EC2Client,
  paginateDescribeFlowLogs,
  paginateDescribeNetworkInterfaces,
  paginateDescribeSubnets,
  paginateDescribeVpcs,
  type FlowLog,
  type TrafficType,
} from "@aws-sdk/client-ec2";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const regions = (flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1").split(",").map((r) => r.trim()).filter(Boolean);
const csvPath = flag("--csv");
const bucketArn = flag("--bucket-arn"); // may contain {region}, e.g. arn:aws:s3:::acme-flow-logs-{region}/vpc/
const trafficArg = (flag("--traffic") ?? "ALL").toUpperCase();
const apply = args.includes("--apply");

const TRAFFIC_TYPES: TrafficType[] = ["ACCEPT", "REJECT", "ALL"];
const traffic = TRAFFIC_TYPES.find((t) => t === trafficArg);
if (!traffic) throw new Error(`--traffic must be one of ${TRAFFIC_TYPES.join(", ")}`);
if (apply && !bucketArn) throw new Error("--apply needs --bucket-arn arn:aws:s3:::bucket[/prefix/]");

interface Row {
  Region: string;
  Vpc: string;
  Name: string;
  Default: string;
  ENIs: number;
  Coverage: string; // "vpc", "partial", "failing" or "none"
  Traffic: string;
  Destination: string;
  Action: string;
}

const describe = (f: FlowLog): string =>
  `${f.LogDestinationType ?? "cloud-watch-logs"}:${f.LogDestination ?? f.LogGroupName ?? "?"}`;

async function scanRegion(region: string): Promise<Row[]> {
  const ec2 = new EC2Client({ region });

  // Every flow log in the Region, grouped by the VPC, subnet or ENI it watches.
  const byResource = new Map<string, FlowLog[]>();
  for await (const page of paginateDescribeFlowLogs({ client: ec2 }, {})) {
    for (const f of page.FlowLogs ?? []) {
      if (!f.ResourceId || f.FlowLogStatus !== "ACTIVE") continue;
      byResource.set(f.ResourceId, [...(byResource.get(f.ResourceId) ?? []), f]);
    }
  }

  // Subnets and network interfaces per VPC, so subnet- or ENI-level logs count as partial coverage.
  const childrenOf = new Map<string, string[]>();
  const addChild = (vpc: string | undefined, id: string | undefined) => {
    if (vpc && id) childrenOf.set(vpc, [...(childrenOf.get(vpc) ?? []), id]);
  };
  for await (const page of paginateDescribeSubnets({ client: ec2 }, {})) {
    for (const s of page.Subnets ?? []) addChild(s.VpcId, s.SubnetId);
  }
  const eniCount = new Map<string, number>();
  for await (const page of paginateDescribeNetworkInterfaces({ client: ec2 }, {})) {
    for (const n of page.NetworkInterfaces ?? []) {
      addChild(n.VpcId, n.NetworkInterfaceId);
      if (n.VpcId) eniCount.set(n.VpcId, (eniCount.get(n.VpcId) ?? 0) + 1);
    }
  }

  const rows: Row[] = [];
  for await (const page of paginateDescribeVpcs({ client: ec2 }, {})) {
    for (const vpc of page.Vpcs ?? []) {
      const id = vpc.VpcId ?? "";
      const own = byResource.get(id) ?? [];
      const healthy = own.filter((f) => f.DeliverLogsStatus !== "FAILED");
      const partial = (childrenOf.get(id) ?? []).some((child) => byResource.has(child));
      const coverage = healthy.length ? "vpc" : own.length ? "failing" : partial ? "partial" : "none";
      rows.push({
        Region: region,
        Vpc: id,
        Name: vpc.Tags?.find((t) => t.Key === "Name")?.Value ?? "",
        Default: vpc.IsDefault ? "yes" : "",
        ENIs: eniCount.get(id) ?? 0,
        Coverage: coverage,
        Traffic: [...new Set(own.map((f) => f.TrafficType ?? ""))].join("+"),
        Destination: own.map(describe).join(" "),
        Action: "",
      });
    }
  }

  // Optional fix: one VPC-level flow log to S3 per VPC with no coverage at all.
  const missing = rows.filter((r) => r.Coverage === "none");
  if (missing.length && bucketArn) {
    const destination = bucketArn.replace("{region}", region);
    if (!apply) {
      for (const r of missing) r.Action = `would create (${traffic} -> ${destination})`;
    } else {
      const res = await ec2.send(
        new CreateFlowLogsCommand({
          ResourceType: "VPC",
          ResourceIds: missing.map((r) => r.Vpc), // up to 300 per call for VPCs; batch if you have more
          TrafficType: traffic,
          LogDestinationType: "s3",
          LogDestination: destination,
          MaxAggregationInterval: 600,
          DestinationOptions: { FileFormat: "parquet", HiveCompatiblePartitions: false, PerHourPartition: false },
          TagSpecifications: [{ ResourceType: "vpc-flow-log", Tags: [{ Key: "created-by", Value: "find-vpcs-without-flow-logs" }] }],
          ClientToken: randomUUID(),
        }),
      );
      const failed = new Map((res.Unsuccessful ?? []).map((u) => [u.ResourceId ?? "", u.Error?.Message ?? "failed"]));
      for (const r of missing) r.Action = failed.get(r.Vpc) ?? "created";
    }
  }
  return rows;
}

function toCsv(rows: Row[]): string {
  const cols: (keyof Row)[] = ["Region", "Vpc", "Name", "Default", "ENIs", "Coverage", "Traffic", "Destination", "Action"];
  const cell = (v: string | number) => `"${String(v).replace(/"/g, '""')}"`;
  return [cols.join(","), ...rows.map((r) => cols.map((c) => cell(r[c])).join(","))].join("\n") + "\n";
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of regions) rows.push(...(await scanRegion(region)));
  console.table(rows.map(({ Destination, ...shown }) => shown));

  const count = (c: string) => rows.filter((r) => r.Coverage === c).length;
  console.log(
    `${rows.length} VPCs: ${count("vpc")} with a VPC-level flow log, ${count("partial")} partial, ` +
      `${count("failing")} failing delivery, ${count("none")} with no flow logs`,
  );
  const idle = rows.filter((r) => r.Coverage === "none" && r.ENIs === 0).length;
  if (idle) console.log(`${idle} of the uncovered VPCs have no network interfaces: consider deleting them instead`);
  if (csvPath) {
    writeFileSync(csvPath, toCsv(rows));
    console.log(`Wrote ${rows.length} rows to ${csvPath}`);
  }
  if (!apply) console.log("Dry run: no flow log was created. Add --bucket-arn to preview and --apply to create.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Report only, two Regions, with a CSV for the review
AWS_PROFILE=readonly npx tsx find-vpcs-without-flow-logs.ts --regions us-east-1,eu-west-1 --csv vpc-flow-logs.csv

# Preview the fix: one Parquet flow log per uncovered VPC, into a bucket per Region
AWS_PROFILE=netadmin npx tsx find-vpcs-without-flow-logs.ts --regions us-east-1,eu-west-1 \
  --bucket-arn "arn:aws:s3:::acme-flow-logs-{region}/vpc/"

# Create them
AWS_PROFILE=netadmin npx tsx find-vpcs-without-flow-logs.ts --regions us-east-1,eu-west-1 \
  --bucket-arn "arn:aws:s3:::acme-flow-logs-{region}/vpc/" --apply

┌─────────┬─────────────┬─────────────────────────┬──────────────┬─────────┬──────┬───────────┬─────────┬───────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Vpc                     │ Name         │ Default │ ENIs │ Coverage  │ Traffic │ Action                                                    │
├─────────┼─────────────┼─────────────────────────┼──────────────┼─────────┼──────┼───────────┼─────────┼───────────────────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'vpc-0a1b2c3d4e5f60718' │ 'prod'       │ ''      │ 64   │ 'vpc'     │ 'ALL'   │ ''                                                        │
│ 1       │ 'us-east-1' │ 'vpc-0b2c3d4e5f6071829' │ 'staging'    │ ''      │ 21   │ 'partial' │ ''      │ ''                                                        │
│ 2       │ 'us-east-1' │ 'vpc-1a2b3c4d'          │ ''           │ 'yes'   │ 0    │ 'none'    │ ''      │ 'would create (ALL -> arn:aws:s3:::acme-flow-logs-us-east-1/vpc/)' │
│ 3       │ 'eu-west-1' │ 'vpc-0c3d4e5f607182930' │ 'data'       │ ''      │ 12   │ 'failing' │ 'REJECT'│ ''                                                        │
│ 4       │ 'eu-west-1' │ 'vpc-0d4e5f60718293a41' │ 'batch'      │ ''      │ 7    │ 'none'    │ ''      │ 'would create (ALL -> arn:aws:s3:::acme-flow-logs-eu-west-1/vpc/)' │
└─────────┴─────────────┴─────────────────────────┴──────────────┴─────────┴──────┴───────────┴─────────┴───────────────────────────────────────────────────────────┘
5 VPCs: 1 with a VPC-level flow log, 1 partial, 1 failing delivery, 2 with no flow logs
1 of the uncovered VPCs have no network interfaces: consider deleting them instead
Dry run: no flow log was created. Add --bucket-arn to preview and --apply to create.