AWS Administration Cookbook

How to do it...

1. Start by defining the template version and description:

      AWSTemplateFormatVersion: "2010-09-09"       Description: Flow logs for networking resources

2. Define the Parameters for the template. In this case, it is just the VpcId to turn logging on for:

      Parameters:         VpcId:           Type: String           Description: The VPC to create flow logs for

3. Create the Resources section of the template and define the log group to use to send our flow-logs to:

      Resources:         LogGroup:           Type: AWS::Logs::LogGroup           DeletionPolicy: Delete           Properties:             LogGroupName: LogGroup

4. Next we define the IAM role that will give the flow-logs service permission to write the logs:

        IamRole:           Type: AWS::IAM::Role           Properties:             AssumeRolePolicyDocument:  Version: "2012-10-17" ...