From 9f3d8d44433fbb54c80597e8c33fb4ce7b068fed Mon Sep 17 00:00:00 2001 From: Poornima Krishnasamy Date: Thu, 14 Dec 2023 17:01:23 +0000 Subject: [PATCH] Add runbook to analyze vpc flow logs --- .../source/analyze-vpc-flow-logs.html.md.erb | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 runbooks/source/analyze-vpc-flow-logs.html.md.erb diff --git a/runbooks/source/analyze-vpc-flow-logs.html.md.erb b/runbooks/source/analyze-vpc-flow-logs.html.md.erb new file mode 100644 index 00000000..e2cf07e9 --- /dev/null +++ b/runbooks/source/analyze-vpc-flow-logs.html.md.erb @@ -0,0 +1,22 @@ +--- +title: Analyze VPC Flow Logs +weight: 219 +last_reviewed_on: 2023-12-14 +review_in: 6 months +--- + +# <%= current_page.data.title %> + +Cloud Platform `live-1` VPC is connected to various other MoJ AWS accounts VPC using Transit Gateway. In order to debug network connectivity issues +that are coming to/from Cloud Platform VPC, the VPC flow logs are enabled. These logs are stored in an S3 bucket and can be analyzed using Athena when needed. + +The steps involve a pointy-clicky exercise to generate Athena integration by creating a CloudFormation stack using a template and use that as a datasource in Athena +Follow the steps as mentioned in the blog: [AWS blog - Analyze VPC Flow Logs with point-and-click Amazon Athena integration](https://aws.amazon.com/blogs/networking-and-content-delivery/analyze-vpc-flow-logs-with-point-and-click-amazon-athena-integration/). + +Things to note: +- When creating a CloudFormation template, use the `Partition: Daily` option. This will create a partition for each day and will make it easier to query the logs for a specific day. +- Provide Partition start date and end date closer when the issue was observed. The duration is limited to 20 days +- Create two s3 buckets one for CloudFormation template and and another one to store the Athena query results which you will provide when creating the CloudFormation stack. +- When the flow logs are downloaded and the user has investigated the issue, delete the created s3 buckets for CloudFormation template and Athena query results and the CloudFormation stack. + +