Skip to content

Commit 1349ffa

Browse files
authored
[IT-3721] Re-enable VPC flow logs automation (#1331)
We disabled deployment of VPC config to automate enabling of VPC flow log in commit 110dace because we got the following error during deployment.. ``` Resource handler returned message: "Invalid request provided: NoAvailableConfigurationRecorder" ``` I've noticed that AWS config configuration recorder is now enabled in every account. I don't know whether AWS changed something in the back end to enable this or whether it just took time for config recorder to establish recordings. This deployment now works because a configuration recorder has been established all organization accounts. Now we re-enable the VPC flow log automation which is really just a revert of the previous commit to disable the automation.
1 parent caaed33 commit 1349ffa

File tree

1 file changed

+12
-13
lines changed

1 file changed

+12
-13
lines changed

org-formation/725-vpc-flow-logs/_tasks.yaml

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,16 @@ VpcFlowLogsBucket:
2020
LifecycleDataStorageClass: "GLACIER"
2121
LifecycleDataExpiration: "360"
2222

23-
# temporarily disable due to issue IT-3721
2423
# Use AWS config to enable VPC flow logs and configure it to send logs to the central S3 bucket
25-
#AutoEnableVpcFlowLogs:
26-
# DependsOn: VpcFlowLogsBucket
27-
# Type: update-stacks
28-
# Template: aws-config-rule.yaml
29-
# StackName: !Sub '${resourcePrefix}-${appName}-remediate'
30-
# StackDescription: Use AWS config to automatically enable VPC flow logs
31-
# DefaultOrganizationBindingRegion: !Ref primaryRegion
32-
# DefaultOrganizationBinding:
33-
# IncludeMasterAccount: true
34-
# Account: '*'
35-
# Parameters:
36-
# CentralizedS3LoggingBucket: !CopyValue [!Sub '${resourcePrefix}-${appName}-bucket-BucketName', !Ref LogCentralAccount]
24+
AutoEnableVpcFlowLogs:
25+
DependsOn: VpcFlowLogsBucket
26+
Type: update-stacks
27+
Template: aws-config-rule.yaml
28+
StackName: !Sub '${resourcePrefix}-${appName}-remediate'
29+
StackDescription: Use AWS config to automatically enable VPC flow logs
30+
DefaultOrganizationBindingRegion: !Ref primaryRegion
31+
DefaultOrganizationBinding:
32+
IncludeMasterAccount: true
33+
Account: '*'
34+
Parameters:
35+
CentralizedS3LoggingBucket: !CopyValue [!Sub '${resourcePrefix}-${appName}-bucket-BucketName', !Ref LogCentralAccount]

0 commit comments

Comments
 (0)