VPC Flow Logs to a Log Service Logstore, All Traffic, at One Minute, with Retention
Flow logs for a VPC, vSwitch or elastic network interface written into a Log Service project and logstore the module creates with the retention you choose, all traffic rather than only what was allowed, at one-minute resolution rather than ten, and your KMS key on the logstore if you hold one. A narrower capture has to be accepted by name.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "vpc_flow_logs" {
source = "www.iac-bazaar.com/iac-bazaar/alicloud-vpc-flow-logs/alicloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
alicloud-vpc-flow-logs
Network flow logs on Alibaba Cloud VPC, written to a Log Service logstore. Works with Terraform and OpenTofu
(>= 1.6), alicloud provider >= 1.0, < 2.0.
All traffic, not only what was allowed. Narrowing traffic_type has to be accepted by name.
One-minute records. Ten-minute aggregation cannot separate two events inside one window.
Retention is the decision. 30 days by default; it sets both the bill and how far back you can look.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
alicloud-actiontrail
An ActionTrail trail that records every region and both reads and writes (narrower by name), delivered to an OSS bucket you own through the service role and, when a project is given, to Log Service for queries. The console keeps ninety days and forgets; the trail is what keeps more. An organization trail collects every member account from the management account.
alicloud-monitoring-alarms
CloudMonitor alarm rules from a map of metrics and thresholds, each firing at the critical level after three consecutive breaches and quiet for an hour after, effective all day, and all sending to a contact group created here with the contacts you name. A group with no contacts notifies nobody and has to be accepted by name.
ibm-vpc-flow-logs
A VPC flow log collector writing into a Cloud Object Storage bucket the module creates with an expiry rule and your Key Protect key if you hold one, plus the is to cloud-object-storage Writer authorization without which a collector reports active and logs nothing - the usual reason an IBM flow log leaves an empty bucket. An inactive collector has to be accepted by name.
aws-vpc-flow-logs
Flow logs for an existing VPC in the extended format an investigation needs (flow direction, TCP flags, packet addresses through NAT), at one minute rather than ten, all traffic rather than rejects, to a CloudWatch log group created with retention and your KMS key, or to S3 as Hive-partitioned Parquet when a bucket is given. Partial traffic and the AWS-managed key are accepted by name.
azure-flow-logs
enabled = false creates a flow log that logs nothing; a retention policy that is off keeps the JSON blobs until somebody deletes the storage account; and without Traffic Analytics nobody ever opens them. Every target is created enabled, retention defaults to 90 days, and Traffic Analytics is on whenever a workspace is given - raw blobs with no aggregation have to be asked for.
oci-vcn-flow-logs
VCN flow logs for the subnets you list, since OCI logs per subnet and a subnet added later has none: a log per subnet in a log group created or given, category all rather than reject, ninety days of retention rather than the thirty-day default, and the subnet map as the list to update. Flow logs are the largest log in a tenancy; the map is also the bill.