# twitch-vpc-flow-logs

Sets up VPC flow logs to measure security expectation [I11]. This sets up a
cloudwatch log group that receives logs of traffic from the configured VPC.
Getting the egrees IP addresses can be queried in AWS insights using the
following query:

```
stats count(*) as dstCount by dstAddr
| sort dstCount desc
| head 5000
```

If you copy this output using the copy functionality from cloudwatch insights,
you can use the `validate-egress` script to check to make sure all traffic is
accounted for.

```
go run code.justin.tv/admin-services/terraform validate-egress \
    < insights-output.txt \
    > out.csv
```

[I11]: https://wiki.twitch.com/display/SEC/Expectation+I11
