Description

Detects AWS Global Accelerators that have flow logs disabled, which reduces network traffic visibility and monitoring capabilities. Flow logs are important for security analysis, troubleshooting, and compliance auditing as they capture information about the IP traffic going to and from network interfaces in your accelerator.

Detection Strategy

• Scans all Global Accelerators in the AWS account

• Checks the FlowLogsEnabled attribute for each accelerator

• Reports a vulnerability when an accelerator has FlowLogsEnabled set to false or missing