vpc flow log no data incloudwatch

0

we set up a ec2 instance and run python3 http server on port 63320,

then we create a vpc flow log and destination is cloudwatch then we visit the ec2 using http and it shows the current file under EC2 home directory, we download one file from the chrome browser. but there is no log stream generated after 2 hour. why there is no log stream

質問済み 2年前654ビュー
2回答
1

Hi there,

It looks like VPC Flow Log is unable to assume the role. Could you check the IAM role associated with the VPC Flow log and make sure it has required Trust Relationship that is allowing VPC Flow Log to assume that role. The trust relationship should look like below:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "vpc-flow-logs.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
} 

This can also be seen from Step 9 of this document which is creating a Role for VPC Flow Log and changing the Trust Relationship policy from Allowing EC2 to Allowing VPC Flow Log. Once VPC Flow Log is able to assume the associated role the Flow Logs should start appearing on your CloudWatch Log Group, considering you have confirmed that adequate permissions are in place on the role.

Additionally, it seems like you are using existing role possibly used by other services such as EC2 - if this is the case we recommend you to create a separate new role just for VPC Flow Logs purpose to avoid any unintentional issues caused by permission issues. You can follow the document provided above to create the required role.

Hope this helps!

AWS
サポートエンジニア
回答済み 2年前
0

Do you have an IAM role associated with the VPC Flow Log with enough permissions to publish into CloudWatch logs? If not, check this link - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html -. It explains the permissions needed.

AWS
Pablo_S
回答済み 2年前
  • yes, my iam role is AdminAccess for VPC flow log, there is error message "log destination is not accessable", but my log destination is /aws/vpc/flowlog1, if I double click this destination, it will go to the log group, but no logstream. not sure why

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン