Google CloudStatic-verified

Flow Logs That Warn When They Are Logging Nothing

VPC Flow Logs configs through the Network Management API, one per network, subnet, VPN tunnel or Interconnect attachment. A config for a target that does not exist is accepted and logs nothing, so a check block warns on it. Filters and sampling are reported by name, and the defaults stay Google's most complete: every flow, 5-second aggregation, all metadata.

terraformGoogle Cloudgcp

Compare Network Flow Logs across clouds →

gcp-vpc-flow-logsvizier v1.2.0

Verification

Static-verified

Passed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).

Conformance

  • Static validation (fmt · validate · tflint)
  • No applicable security policies for this provider
  • Plan tests (mocked: validation rules · outputs)

Provenance

  • SHA-256 checksum
  • Signature (pending)

Functional

  • Live test pending (no cloud run yet)

Last verified 2026-09-16 · how we verify

Use it from the registry

terraform · opentofu
module "vpc_flow_logs" {
  source  = "www.iac-bazaar.com/iac-bazaar/gcp-vpc-flow-logs/gcp"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Documentation

gcp-vpc-flow-logs

VPC Flow Logs on Google Cloud Network Management. Works with Terraform and OpenTofu (>= 1.6), google provider >= 7.10.0, < 8.0.

A config for a target that does not exist is accepted and logs nothing. The API reports it afterwards in target_resource_state; a check block turns that into a warning and targets_not_found lists the configs.

A filter decides what nobody will ever see. filtered_configs names every config with a filter_expr.

The defaults are the most complete and the most expensive: every flow, 5-second aggregation, all metadata. Lower them per config where cost matters more than completeness; sampled_configs reports where.

Targets are networks, subnets, VPN tunnels and Interconnect attachments, exactly one per config, as full resource paths. Network and subnet targets need google provider 7.10.0 or later.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Usage

Related modules

Static validatedLive test pending

gcp-log-sink

Creating a sink creates a service account for it and grants that account nothing, so until it holds a role on the destination every export fails - the sink shows active, the destination stays empty, and the errors are logged into the project that was supposed to be exported. Grants the role with the sink, refuses an empty filter, and can manage _Default retention past 30 days.

View module
Static validatedLive test pending

gcp-uptime-check

A Cloud Monitoring uptime check from static-address checkers in several regions, over TLS with the certificate validated (off by default), asserting on the body when you give it text, with failures logged, and the alert policy on check_passed that sends to your notification channels. Plain HTTP and a policy with no channels are each accepted by name.

View module
Static validatedLive test pending

gcp-audit-logging

Data Access logs are off by default for every service but BigQuery, so a project that never turned them on has no record of who read the bucket, queried the table or fetched the secret. Enables all three log types for allServices, narrows per service where read volume is a real cost, and requires a reason for every exempted member - the setting an intruder with IAM rights would add.

View module
Live-tested

gcp-monitoring

A self-contained observability bundle: a metric-threshold alert policy, a Monitoring dashboard, and a log-export sink to a locked-down GCS bucket with the sink writer-identity IAM grant wired in.

View module
Static validatedLive test pending

ibm-vpc-flow-logs

A VPC flow log collector writing into a Cloud Object Storage bucket the module creates with an expiry rule and your Key Protect key if you hold one, plus the is to cloud-object-storage Writer authorization without which a collector reports active and logs nothing - the usual reason an IBM flow log leaves an empty bucket. An inactive collector has to be accepted by name.

View module
Static validatedLive test pending

aws-vpc-flow-logs

Flow logs for an existing VPC in the extended format an investigation needs (flow direction, TCP flags, packet addresses through NAT), at one minute rather than ten, all traffic rather than rejects, to a CloudWatch log group created with retention and your KMS key, or to S3 as Hive-partitioned Parquet when a bucket is given. Partial traffic and the AWS-managed key are accepted by name.

View module