Skip to content

Commit

Permalink
Add runbook to analyze vpc flow logs (#5098)
Browse files Browse the repository at this point in the history
* Add runbook to analyze vpc flow logs

* Commit changes made by code formatters

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
  • Loading branch information
1 parent 52ffd1d commit 004d864
Showing 1 changed file with 20 additions and 0 deletions.
20 changes: 20 additions & 0 deletions runbooks/source/analyze-vpc-flow-logs.html.md.erb
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
---
title: Analyze VPC Flow Logs
weight: 219
last_reviewed_on: 2023-12-14
review_in: 6 months
---

# <%= current_page.data.title %>

Cloud Platform `live-1` VPC is connected to various other MoJ AWS accounts VPC using Transit Gateway. In order to debug network connectivity issues
that are coming to/from Cloud Platform VPC, the VPC flow logs are enabled. These logs are stored in an S3 bucket and can be analyzed using Athena when needed.

The steps involve a pointy-clicky exercise to generate Athena integration by creating a CloudFormation stack using a template and use that as a datasource in Athena
Follow the steps as mentioned in the blog: [AWS blog - Analyze VPC Flow Logs with point-and-click Amazon Athena integration](https://aws.amazon.com/blogs/networking-and-content-delivery/analyze-vpc-flow-logs-with-point-and-click-amazon-athena-integration/).

Things to note:
- When creating a CloudFormation template, use the `Partition: Daily` option. This will create a partition for each day and will make it easier to query the logs for a specific day.
- Provide Partition start date and end date closer when the issue was observed. The duration is limited to 20 days
- Create two s3 buckets one for CloudFormation template and and another one to store the Athena query results which you will provide when creating the CloudFormation stack.
- When the flow logs are downloaded and the user has investigated the issue, delete the created s3 buckets for CloudFormation template and Athena query results and the CloudFormation stack.

0 comments on commit 004d864

Please sign in to comment.