Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add runbook to analyze vpc flow logs #5098

Merged
merged 2 commits into from
Dec 14, 2023
Merged

Add runbook to analyze vpc flow logs #5098

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9f3d8d4
Add runbook to analyze vpc flow logs
poornima-krishnasamy Dec 14, 2023
d8037ea
Commit changes made by code formatters
github-actions[bot] Dec 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions runbooks/source/analyze-vpc-flow-logs.html.md.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
---
title: Analyze VPC Flow Logs
weight: 219
last_reviewed_on: 2023-12-14
review_in: 6 months
---

# <%= current_page.data.title %>

Cloud Platform `live-1` VPC is connected to various other MoJ AWS accounts VPC using Transit Gateway. In order to debug network connectivity issues
that are coming to/from Cloud Platform VPC, the VPC flow logs are enabled. These logs are stored in an S3 bucket and can be analyzed using Athena when needed.

The steps involve a pointy-clicky exercise to generate Athena integration by creating a CloudFormation stack using a template and use that as a datasource in Athena
Follow the steps as mentioned in the blog: [AWS blog - Analyze VPC Flow Logs with point-and-click Amazon Athena integration](https://aws.amazon.com/blogs/networking-and-content-delivery/analyze-vpc-flow-logs-with-point-and-click-amazon-athena-integration/).

Things to note:
- When creating a CloudFormation template, use the `Partition: Daily` option. This will create a partition for each day and will make it easier to query the logs for a specific day.
- Provide Partition start date and end date closer when the issue was observed. The duration is limited to 20 days
- Create two s3 buckets one for CloudFormation template and and another one to store the Athena query results which you will provide when creating the CloudFormation stack.
- When the flow logs are downloaded and the user has investigated the issue, delete the created s3 buckets for CloudFormation template and Athena query results and the CloudFormation stack.