> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/configure-flow-logs.md). # Configure Flow Logs Prisma Cloud ingests the VPC flow logs from Amazon S3 buckets stored in a logging account and makes it available for network policy alerting and visualization. After onboarding your AWS account, you must onboard the logging account which has the S3 bucket storing VPC flow logs for the monitored account. The default retention period of flow logs is 30 days after which they are purged. You can query flow logs data for the last 30 days. CloudWatch is the default selection to ingest flow logs and does not require additional configuration. When creating S3 flow logs on the AWS console, make sure to partition your flow logs for **Every 1 hour (60 minutes)**. The hourly (60 minutes) partition provides better ingestion performance than the 24 hours partition. Selecting additional fields on the AWS console that are used in the Internet exposure calculation in network policies address the false positives for those network policies. 1. On your AWS console, create a flow log with the following specifications. 1. The new flow logs format requires all connection direction related fields. Here’s a sample format:
aws s3 sample flowlogs 1
2. It is recommended to **Select all** instead of manually selecting each field. However, if you choose **Custom format**, make sure you select the following (required) fields: * account-id * action * interface-id * srcaddr * dstaddr * srcport * dstport * protocol * packets * bytes * start * end * log-status * region * version * tcp-flags * flow-direction * traffic-path * vpc-id * subnet-id * instance-id * pkt-srcaddr * pkt-dstaddr * pkt-src-aws-service * pkt-dst-aws-service
aws s3 sample flowlogs 2
NOTE: Flow log ingestion will not be impacted if you select all the fields. 3. Set **Partition logs by time** to **Every 1 hour (60 minutes)**.
aws s3 sample flowlogs 3
4. Set **Log file format** to **Text**. Prisma Cloud supports ingestion of only text format files.
aws s3 sample flowlogs 4
2. You are not required to change anything on Prisma Cloud as long as the S3 bucket does not change. ## Onboarded Accounts that Use S3 For your previously onboarded AWS accounts that are using S3 with 24 hours partition, you can now select hourly partition. Prisma Cloud checks whether flow logs have all the necessary permissions required for hourly partition (it does not check for the fields). 1. After you [Onboard Your AWS Account](/content-collections/connect/connect-cloud-accounts/onboard-aws/onboard-aws-account.md), select **Settings > Providers > Cloud Accounts**. 2. Click the **View** icon next to the AWS account for which you want to configure the logging account and buckets to fetch flow logs from S3. 3. Select **Threat Detection** and select **S3** under **Flow Logs**. 4. Click **Configure S3**.
configure flow logs 1
5. **Select Logging Account**. 1. Click **Add Logging Account** (follow Step 6) or select from the logging accounts displayed (if you have previously set up logging accounts). 2. Click **Next**.
configure flow logs 2
6. **Add Logging Account**.
aws add logging account
1. Enter an **Account ID**, **Account Name**, and **Role Name**. By default, the role name is **prisma-cloud-logging-role**, which you can customize. 2. Enter a **Bucket Name** and the **Bucket Region** that you have configured as a destination for flow logs on the AWS Logging Account VPC Console. The **Bucket Path Prefix** (comma separated list) and **Key ARN** are optional. If you have any specific path (Bucket Path) prefix for flow logs and configured bucket encryption (Key ARN), you can enter those values. If you’ve enabled hourly partitions, the files are published to the following location: *bucket-and-optional-prefix/AWSLogs/account\_id/vpcflowlogs/region/year/month/day/hour/* In AWS, the *bucket-and-optional-prefix* is added to the S3 bucket ARN as a folder in the flow logs settings page. Make sure you add the same *bucket-and-optional-prefix* in the prefix section in Prisma Cloud. 3. **Add** or **Remove** multiple buckets used for logging. 4. **Download the Template Script**. Click **View steps** to see the detailed information. 5. Enter the **External ID** and **IAM Role ARN** and click **Validate**. You can proceed further only if the validation is successful and you see a green **Validated** checkmark. The CFT template is deployed on the Logging Account through your AWS Management Console. 6. Click **Save**. 7. **Configure S3 Flowlogs**.
aws configure s3 flowlogs
1. Select all the applicable **Logging Buckets** that Prisma Cloud can access and from which it can ingest flow logs. 2. After selecting the Logging Buckets, click **Validate** to make sure Prisma Cloud has all basic required permissions and access. If all the required permissions are present, a green **Validated** checkmark displays. If not, an error message displays. If you want to configure a different logging account and buckets, click the **Edit** icon. 3. Click **Save**. You can save your settings, regardless of the validation status. For accounts that are using CloudWatch and now you want to upgrade to S3, the **Enable Hourly Partition** checkbox is enabled (grayed out) by default to ensure it is using hourly partition. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/configure-flow-logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.