AwsSolutions-VPC7
VPC has no flow logs
What it means
The VPC does not have flow logging enabled.
Why it matters
Flow logs are the network equivalent of access logs, and their absence is the reason many incident reviews end in speculation. A connection you did not expect leaves no trace, so "did anything reach it" is unanswerable. Nothing about a VPC without them behaves differently, which is exactly why it survives review.
How to fix it
Add a flow log to the VPC targeting CloudWatch Logs or S3: `new FlowLog(this, "FlowLog", { resourceType: FlowLogResourceType.fromVpc(vpc) })`.
See it fail
This stack trips AwsSolutions-VPC7 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.
Open “VPC without flow logs” in the playground →