Hear you.
And welcome back.
Now into this video we'll be discussing about the basics of VPC flow locks.
Now, before we go ahead and understand about the feature of VPC flow log, let's take a simple analogy
to understand the use case behind the feature.
So the simple analogy for today's video is based on a visitor register, and this is pretty common in
India.
So generally whenever you visit any society or maybe even offices in India, the security guard will
basically ask you to fill in your details within the visitor register.
So this details that you have to fill includes your name from which place you have come, which is the
destination place and the destination person you want to meet.
You also have to fill in the entry date and time.
And while you are leaving this area, you also have to fill in the exit date and time and also the purpose
of work.
Now, this is very useful because ID and it allows the security agency to keep track of who is visiting
and if there are any issues that arises, then they can quickly refer to the information that is part
of the visitor register as part of that investigation.
Now, in a similar way, even for your environment, you can have multiple servers and there can be
thousands of users who might be visiting your website every day.
So you might have a genuine users.
You might also have hackers who might try to attack your servers and so on.
So what you need in an environment is a feature similar to the visitor register, which gives you information
about the IP addresses that are visiting your website so that it allows you to keep track on what exactly
is happening in terms of network traffic to your environment.
Now this feature is accomplished with the help of VPC flow log.
So VPC Flow log is a feature that enables you to capture information about the IP traffic going to and
from the network interfaces in your VPC.
So you can basically consider it as a visitor register.
Now one of the question that comes is what exactly is captured in the VPC flow log, because we have
already seen what is captured in terms of the visitor register here.
So in terms of capture information scope specifically for the VPC flow log, first thing that it will
capture is it will record the traffic information that is visiting your resources, like EC2 instance.
For example, let's say this user is visiting the EC two instance, so it will log stating that a user
from the IP 1077 2.50 has connected to the easy two instance.
It will also give you more information about what is the IP of the EC two instance and so on.
So this is one thing that it will capture.
The second scope of capture is if a resource from your environment like EC two instance, if the resource
is connecting outbound and this is very common across the servers that are breached specifically nowadays
Bitcoin mining is very popular.
So in case if your server is breached, you will see that the attacker would typically install bitcoin
mining related packages here.
So VPC flow log will also capture the information specifically when you see two instances connecting
to an outgoing IP.
So here it is capturing EC two instance connecting to IP 192 160 0.5 So not only visitors IP registered
but also the IP addresses that your environment is connecting to.
That is also registered.
So these are the two primary information scope of capture for VPC flow log.
So this is basically a sample screenshot associated with a VPC flow log.
So this basically let me give you a high level overview of what is basically means.
So the first IP that you see over here is a source IP.
So what is basically means someone from this specific IP 52 zero 5 to 44.36 is trying to connect to
a resource with the IP of one 7231 94.2 39 And this is the timestamp where the connection was made.
Now this is very important specifically when the website gets breached.
VPC flow log is one of the first things that is being checked and generally specifically if you are
building dashboards specifically nowadays a lot of organizations are doing and even in the security
operations center where things are monitored continuously, 24 seven many of these dashboards look something
like this.
So it basically looks into the traffic flow, the top destination port.
So in this case, you see the top destination port is 22.
So someone is trying to connect to the port 22 which visit the SSH of the easy to instance.
It also shows you basically from which geographic location the connection is from.
So let's say that you have an e commerce website just based on India, and now you are seeing huge surge
of traffic from maybe a different country, Russia, China, etc..
So that is something that needs to be looked upon primarily because their primary visitors would only
be from India.
So a lot of things go around.
Specifically when you're building the VPC flow log related dashboard.
So with this said, let me go ahead and give you a quick demo about VPC flow log.
So currently in my environment there are two EC, two instances that are running and I also have a VPC
flow log that is enabled.
Now let me show you how that can be done.
So if I quickly open up the VPC.
So this is basically a default VPC over here and under the flow logs you will see that I have a VPC
flow log that is enabled over here.
Now, I already enabled it a few days back because I just wanted to give you an overview about the type
of traffic that you will see.
So all of the information from the VPC flow log is basically stored in cloud watch.
So if I quickly open up the log groups over here, let's open up the VPC flow log.
And within the log stream you see that there are two log streams over here, primarily because there
are two EC2 instances that are running in this specific region and it is capturing information for both
of the easy two instances.
So if I quickly open up the log stream over here.
So here you see that you have a lot of log entries specifically related to the VPC flow log.
So all of these IP is most of the cases, they are specifically related to the malicious person who
is trying to connect to the environment, maybe as part of the Nmap scanning or maybe a direct brute
force and so many others.
So if you're working in security, this is one of the very interesting thing that you will see specifically
if you log things in more detail.
So let's take an example over here.
So this is one of the entries here.
So in this entries here, you see this specific portion.
This is the IP address, 45 155 205 99 And this IP address is trying to connect to one of the EC2 instances
that is running in the North Virginia environment.
And within here you basically see reject.
So basically the packet was rejected primarily maybe because of a security group here.
Now let's quickly look into where this IP address is coming from.
So let me go ahead and do a copy here and let's quickly open up one of the website that can do an IP
lookup over here.
So when I just paste in the IP address over here, let's see from which country.
So you see the country is Russia.
Someone from St Petersburg is trying to connect to my demo EC2 instance, which is running in the North
Virginia region and this is pretty common.
So any website that you are running in production environment, you will see a lot of visitors from
across the world who are trying to connect to various interesting ports, SSH, my SQL Port eight and
so many others.
So a lot of interesting dashboards you can build.
And on top of this data, you can also go ahead and build up security solutions that can block certain
IP.
So many times what happens is that from one single IP, you will see tens of thousands of requests throughout
the week.
So in such cases, what organization do they add it within the block list?
So directly the network traffic inbound or TCP connection would be rejected outright.
So with this I hope at a high level overview, you understood the basics of VPC flow and also look into
what kind of use case it is trying to solve.
Now, before we conclude, let me also show you on how you can go ahead and enable VPC flow log.
Now let's take a sample VPC in one of the regions over here, and this VPC is basically a default VPC.
So now you have an option called flow logs, and by default the flow logs are not enabled.
So what you can go ahead and do, you can go ahead and click on create a flow log within here.
You have to specify various things like name filter and various other things.
So first let's do one thing.
Let's go ahead and enable the cloud watch logs.
So within the cloud service, let's quickly open this up.
Within the service.
Let us go to log groups and let's go ahead and create a log group over here.
So log group is basically where the VPC flow log data will be stored.
So I'll just call it as VPC flow logs and click on create.
That's great.
So now within the VPC flow log setting, you have to give a name.
So let's let's call it as demo flow log.
Now, within the filter, you can specify what type of traffic you want to capture.
So generally one of the important things to capture is also the reject traffic because it will give
you a lot of information.
So best way is to capture all traffic.
So let's give it an all and within the maximum aggregated interval, let's keep it default.
And then comes the important setting of destination in which destination you want to store the data.
I'll say send it to cloud, which logs within the destination log groups.
Let's go ahead and select the VPC flow logs that we have created and for the IAM role in case you,
if you do not have a IAM role, you can go ahead and quickly do that.
So you can click on set up permission and it will automatically give a role name and the associated
policy for that role.
All you have to do is you have to click on allow.
Perfect.
So once you have created the IM role, let's quickly refresh this and now you can just specify the flow
logs role and the log record format.
Let's keep it the default one and we can go ahead and create a flow log.
That's great.
So the flow log is created.
So if we'll quickly open up here, you see the flow log is created.
Now the next thing to do is let's go to the EC two instance here.
Let's open up the instances and let's go ahead and start one of the easy two instance that is running
in this environment.
So I'll go ahead and start it.
Now within the security group, let's quickly look into what are the rules that are available.
So you have a rule of 80 on 0000.
You have a rule of 20 on 0000.
So what you need to do, just keep the EC2 instance running for a while and then in the flow logs you
will see a lot of interesting entries here.
So what we'll do is we'll pause this video and maybe after a little amount of why of the EC two instance
build running will then explore the VPC flow log to see some of the interesting entries.
So with this, we'll quickly pause this video right now.
All right.
So it has been closed to around 15 minutes and our useful VPC flow log is now ready.
Now, this is basically showing you one of the interfaces, primarily because we only have one EC2 instance
that is running.
So let's quickly open this up and let's look into how many network traffic has been completed within
the past 15 minutes.
And here you see there are a lot of connections that are happening within just a short span of time
and some of the connections are accepted and some of the connections are rejected.
So they are basically rejected at a security group level, primarily because we do not have a rule that
is allowed here.
So let's open up one among them.
Let's quickly expand here and basically we know that this is the source IP and this is the destination
IP 246 You can even verify it.
So if we'll quickly open up the easy to instance details over here within the destination IP, you see
you have 46.2 46 something similar to here.
So let's look into what is the source IP here in terms of which country it has come from.
So you can just do IP location.
There are a lot of websites that will basically give you the location based on the IP address.
So let me just paste one of the IP address that we found and interesting.
This IP address, again, it now it has come from Moscow, from Russia.
Let's also explore for you among them you also have something from 193.
Let's try it out.
So this has come from Ukraine.
Interesting.
So we have a lot of interesting visitors for our demo environment.
Now, generally in the organization that I have worked with, like, you will typically see almost all
of the countries in VPC flow log except the continent of Antarctica.
Great.
So at this stage we'll keep it simple, I hope at a high level overview you understood the basics of
VPC flow log and also the importance of it of enabling it within the production environment.
So with this will conclude today's video.