Skip to main content

Illumio Segmentation for the Cloud User Guide

Set up flow logs in your AWS environment

Learn how to grant flow log access by Illumio Segmentation for the Cloud.

Illumio Segmentation for the Cloud uses flow logs to provide visual diagrams and analysis of traffic between sources and destinations. After you set up flow logs, you must grant Illumio Segmentation for the Cloud access to these flow logs through your CSP.

  1. Set up flow logs.

  2. Review destinations before granting flow log access.

    See Review destinations before granting flow log access.

  3. Review prerequisites for granting flow log access.

    See Prerequisites for granting flow log access to AWS.

  4. Grant flow log access.

    See Grant flow log access to your AWS instance.

Note

Do you have central log storage or cross-account storage? This is where flow logs generated from one account (such as "account A1") are stored in a destination belonging to another account (such as "account A2").

You can onboard the accounts in any order, but if you onboard "account A1" first, you will not see its flow logs until you onboard "account A2." See Onboarding AWS Cloud.

If you onboard the account that stores the flow logs ("account A2") first, you will not see the "account A1" traffic because it has not yet been onboarded.

You must also onboard the account that is generating flow logs ("account A1"). Otherwise, Illumio Segmentation for the Cloud does not properly map the flow logs.

You must onboard both.

Set up flow logs in AWS

Set up flow logs in AWS using the console, a CloudFormation template, or the command line. You must do this before you Grant flow log access to your AWS instance.

Note

For AWS, Illumio Segmentation for the Cloud can read flows from S3 buckets only, so configure these accordingly.

For multi-account AWS customers, Illumio recommends deploying a centralized log storage strategy. This allows you to configure a single S3 bucket destination for all cross-VPC and cross-account flow logs. For details on configuring the necessary roles and permissions, see the AWS website.

Set up AWS flow logs using the console

To configure flow logs for a VPC in the AWS console:

  1. Go to the VPC console at https://console.aws.amazon.com/vpc/ and select the region to which the VPC belongs.

  2. Select the VPC for which flow logs are to be enabled.

  3. Under the VPC details page, select the Flow logs page and click the Create flow log button.

  4. Provide the following details in the flow log configuration page:

    • Name for the flow log config

    • Type of traffic to be filtered. For more insights, select All.

    • The time interval can be set to 10 minutes

  5. Select Send to an Amazon S3 bucket and paste the ARN of the S3 bucket. It also provides the option to create a new S3 bucket from there.

  6. To access new product features without changing your configuration settings, Illumio strongly recommends that you enable all fields up to the latest version (version 5).

    Version

    Fields to Enable

    Rationale

    2

    version, account-id

    interface-id

    srcaddr

    dstaddr

    srcport

    dstport

    protocol

    packets

    bytes

    start

    end

    action

    log-status

    Baseline telemetry: Provides essential packet/byte counts, source/destination, ports, protocol, and action.

    This is required for flow visibility.

    3

    vpc-id

    subnet-id

    instance-id

    tcp-flags

    type

    pkt-srcaddr

    pkt-dstaddr

    Required enhancement: Adds topology context (VPC, subnet, instance) and deeper TCP details.

    This improves map visualization.

    4

    region

    az-id

    sublocation-type

    sublocation-id

    Required enhancement: Provides placement info (region, AZ, edge locations). This is useful to verify the region field visibility. This is not a required filed for product functionality but helps to verify the region field presented on traffic records.

    5

    pkt-src-aws-service

    pkt-dst-aws-service

    flow-direction

    traffic-path

    Required enhancement: Adds flow directionality and AWS service metadata.

    This is required for correct traffic flow direction interpretation.

    7

    ecs-cluster-

    ecs-container-

    ecs-task-*

    ecs-service-name

    Optional enhancement: Supports future use cases. Provides ECS task/container context.

    This is not required.

    8

    reject-reason

    Optional enhancement: Supports future use cases. Indicates if traffic was blocked by BPA.

    This is useful for troubleshooting and not needed for ingestion.

    For more information, see the AWS User Guide for Flow records.

    Note

    Illumio supports only the Text as Log file format. It does not support the parquet format. You can optionally enable hive-compatible prefixes and partition logs by time. Use defaults for all other values.

  7. Click Create flow log.

Using the CloudFormation template

To enable flow logs for a VPC using the CloudFormation template:

  1. Go to the VPC console page at https://console.aws.amazon.com/vpc/, select the VPC for which the flow logs are to be enabled, and copy the VPC ID.

  2. Go to the S3 console page at https://console.aws.amazon.com/s3/ and select the bucket in which the flow logs are to be stored. Under the Properties tab, copy the name.

  3. Save the following CloudFormation Template to a file named enabling-vpc-flowlogs.yaml.

AWSTemplateFormatVersion: "2010-09-09"
Description: "Enable Flow logs for a vpc"
 
Parameters:
  VpcId:
    Type: String
    Description: VPC Id for which flow logs are to be enabled
  BucketName:
    Type: String
    Description: Name of the bucket in which flow logs are to be stored.
 
Resources:
  FlowLog:
    Type: AWS::EC2::FlowLog
    Properties:
      ResourceId: !Ref VpcId
      ResourceType: "VPC"
      TrafficType: "ALL"
      LogDestination: !Join
        - ""
        - ["arn:aws:s3:::", !Ref BucketName]
      LogDestinationType: "s3"
      LogFormat: "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} ${vpc-id} ${subnet-id} ${instance-id} ${tcp-flags} ${type} ${pkt-srcaddr} ${pkt-dstaddr} ${region} ${az-id} ${sublocation-type} ${sublocation-id} ${pkt-src-aws-service} ${pkt-dst-aws-service} ${flow-direction} ${traffic-path}"
      MaxAggregationInterval: 600
      Tags:
        - Key: "Name"
          Value: "FlowLogsForIllumioCloudSecure"
        - Key: "Purpose"
          Value: "Alltrafficvizualizationmap"
Outputs:
  FlowLogArn:
    Description: The ARN of the created flow log
    Value: !Ref FlowLog

For more information, see the AWS website.

Running the CloudFormation template

  1. Go to the AWS CloudFormation service and use the template file to create a new stack with new resources (standard).

  2. Select Template is Ready and then Upload a template file. Upload the enabling-vpc-flowlogs.yaml file.

  3. On the next page, enter the desired stack name, followed by the bucket name and the VPC ID you copied earlier.

  4. Click Next and leave the default values in the successive pages. In the final page, click Create stack.

After stack creation is complete, go to the VPC console and verify that the flow logs are being created.

Note

The template must be run in the same region as the VPC. Choose the appropriate region on the top right before running the CloudFormation template.

Using the command line

See the AWS website.

What's next for AWS flow logs

Now you can Grant flow log access to your AWS instance.