Flow Logs & Network Traffic Monitoring
Learn how to enable and collect flow logs across AWS, Azure, GCP, and Oracle Cloud to ensure visibility into network traffic and support audit readiness.
Sprinto checks for the presence of flow logs to ensure that your cloud infrastructure is being actively monitored for network-level activity. These logs provide visibility into incoming and outgoing traffic, helping detect misconfigurations, unauthorised access, or policy violations.
Monitoring flow logs is a key requirement in most compliance frameworks, including ISO 27001, SOC 2, and GDPR.
Supported Cloud Providers
AWS
VPC Flow Logs
Capture all IP traffic at the network interface level
Azure
NSG Flow Logs
Monitor traffic flow through Network Security Groups
GCP
VPC Flow Logs
Record connection metadata across VMs and containers
Oracle Cloud
VCN Flow Logs
Capture flow data for Virtual Cloud Networks
When is this check triggered?
This check is triggered if:
Flow logs are not enabled for one or more active cloud networks
Evidence of log collection is missing or outdated
The logging destination (e.g., S3, Azure Storage, GCS) is not properly configured or visible
How to resolve the check
To pass this check, you must:
Enable flow logs for the relevant services in your cloud console.
Verify logging destinations are accessible and collecting logs.
Upload evidence to Sprinto, or allow integration-based collection.
Example: Enable AWS VPC Flow Logs
Go to the VPC Dashboard in the AWS console.
Select your VPC → Click Flow Logs → Create flow log
Choose All traffic for log type.
Set the destination to CloudWatch Logs or S3.
Save and verify logs are being generated.
Repeat similar steps for Azure NSGs, GCP VPCs, and Oracle VCNs.
Evidence requirements
You can provide one of the following as evidence:
A screenshot of the flow log configuration screen
A recent log sample or export
Cloud console JSON configuration output
Integration-based verification (preferred if supported)
Best practices
Retain flow logs for a minimum of 90 days, or as per regulatory requirements.
Regularly review logs for anomalies or misconfigured security groups.
Apply log integrity monitoring (e.g. CloudTrail log file validation) where supported.
Last updated