Cisco
Login
Search
Software Multicloud Defense
Activity Onboard

Traffic Discovery and Visiblilty Types of Traffic Enable VPC Flow Logs GCP: Enable VPC Flow Logs

Last updated: Jul 03, 2025

GCP: Enable VPC Flow Logs

To enable GCP VPC flow logs, follow the below steps.

Procedure

1

In the Security Cloud Control platform menu, choose Products > Multicloud Defense .
2

In the GCP console, navigate to VPC network

3

to enable the VPC flow log, select the subnet.
4

Ensure that flow logs is turned On. If it is off, click the Editoption and turn flow logs on.
5

Turn on flow log on all subnets where you want to enable flow log.
6

Navigate to Cloud Storage section and create a storage bucket. You can leave everything as default when creating storage bucket.


 

Both DNS and VPC logs can share the same cloud storage bucket.
7

Navigate to the Logs Route section.
8

Click Create Sink.
9

Enter a name for the sink.
10

Select Cloud Storage bucket for sink service.
11

Select the cloud storage bucket that was created above.
12

In the Choose logs to include in sink section, enter this string: logName:(projects/<project- id>/logs/compute.googleapis.com%2Fvpc_flows)

If you are sharing a cloud storage bucket, you only need to perform the remaining steps of this procedure once.
13

Click Create Sink.
14

Navigate to IAM > Roles.
15

Create one custom role with this permission: storage.buckets.list.
16

Create one custom role with following permission: storage.buckets.get storage.objects.get storage.objects.list.
17

Add both custom roles to the service account created for Multicloud Defense Controller. When adding the second custom role, enter the following condition:


(resource.type == "storage.googleapis.com/Bucket" || resource.type == 
"storage.googleapis.com/Object") && resource.name.startsWith('projects/_/buckets/<cloud 
storage name>')
18

Navigate to Pub/Subs.
19

Click Create Topic.
20

Provide a Topic name and click Create.
21

Click Subscriptions. A subscription is created for the topic created in step 18.
22

Edit the subscription.
23

Change the Delivery type to Push.
24

Enter this as the endpoint URL:https://prod1- webhook.vtxsecurityservices.com:8093/webhook/<tenant name>/gcp/cloudstorage.

Multicloud Defense automatically assigns the tenant name. To see tenant name, navigate to Multicloud Defense Controller and click on your username.
25

Click Update.
26

Open a Google cloud shell and execute the following command: gsutil notification create -t <TOPIC_NAME> -f json gs://<BUCKET_NAME>.
Previous topic AWS: Enable VPC Flow Logs Next topic Azure: Enable NSG Flow Logs