The Network Management API lets you configure VPC Flow Logs for organizations, Virtual Private Cloud (VPC) networks, subnets, VLAN attachments for Cloud Interconnect, and Cloud VPN tunnels.

📘

Before you begin:

This guide assumes you have permissions with the Network Management Admin role (roles/networkmanagement.admin), granted as follows:

• Organization level (required if you want to configure VPC Flow Logs for an organization)
• Project level (required if you want to configure VPC Flow Logs for a VPC network, subnet, VLAN attachment, or Cloud VPN tunnel)

The following instructions are based on Google documentation here, which may be useful to refer to if needed: https://docs.cloud.google.com/vpc/docs/using-flow-logs

Prerequisites

1. Navigate to <https://console.cloud.google.com/apis/api/networkmanagement.googleapis.com>, and click "Enable".

2. In the Google Cloud console, go to the VPC networks page.

📘

Options for Flow Log Enablement

VPC Flow logs can be enabled at the following levels:

1. Subnet
2. VPC
3. Organization (requires the resourcemanager.organizations.get permission.)

The lowest level policy configured will supercede the higher policy.

Option 1. Enabling VPC Flow Logs at the Subnet Level

1. On the Subnets in current project tab, select one or more subnets and then click Manage flow logs.

2. In Manage flow logs, click Add new configuration. This will configure a new VPC flow log configuration.

3. Do one of the following:

   1. If you selected one subnet, in the Configurations — Subnets section, click Add a configuration.

      

   2. If you selected multiple subnets, in the Configure VPC Flow Logs section, select Network Management API.

      

4. For Name, enter a name for the new VPC Flow Logs configuration.

5. Change the Aggregation Interval to 1 minute.

6. Optional: Adjust the Description and any of the settings in the Advanced settings section:

   1. Log filtering: By default, Keep only logs that match a filter is deselected.
   2. Include metadata in the final log entries: By default, Metadata annotations includes all fields.
   3. Secondary sampling rate: 100% means that all entries generated by the primary flow log sampling process are kept.

7. Click Save.

Option 2. Enabling VPC Flow Logs for VPC Networks

1. On the Networks in current project tab, select one or more networks and then click Manage flow logs.

   

2. In Manage flow logs, click Add new configuration. This will configure a new VPC flow log configuration.

   

3. In the popup window, under Configurations - VPC networks click on Add a configuration.

   

4. For Name, enter a name for the new VPC Flow Logs configuration.

5. Change the Aggregation Interval to 1 minute.

6. Optional: Adjust the Description and any of the settings in the Advanced settings section:

   1. Log filtering: By default, Keep only logs that match a filter is deselected.
   2. Include metadata in the final log entries: By default, Metadata annotations includes all fields.
   3. Secondary sampling rate: 100% means that all entries generated by the primary flow log sampling process are kept.

7. Click Save.

Option 3. Configuring VPC Flow Logs at the Organization Level

Configurations created at an organizational level will apply to all VPCs within that organization.

1. Navigate to the VPC Flow Logs configuration page.

   

2. Click Add VPC Flow Logs configuration and then click Add a configuration for the organization.

   

3. For Name, enter a name for the new VPC Flow Logs configuration.

4. Change the Aggregation Interval to 1 minute.

5. Optional: Adjust the Description and any of the settings in the Advanced settings section:

6. Optional: Adjust the Description and any of the settings in the Advanced settings section:

   1. Log filtering: By default, Keep only logs that match a filter is deselected.
   2. Include metadata in the final log entries: By default, Metadata annotations includes all fields.
   3. Secondary sampling rate: 100% means that all entries generated by the primary flow log sampling process are kept.

7. Click Save.