> Source: [sk144752](https://support.checkpoint.com/results/sk/sk144752)

# sk144752 - How to create an IAM Role for CloudGuard VPC Flow Logs

| Property | Value |
|----------|-------|
| Solution ID | sk144752 |
| Date Created | 2019-01-16 |
| Last Modified | 2022-07-04 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |

## Solution

1. Open the IAM console at <https://console.aws.amazon.com/iam/>.

2. In the navigation pane, select **Roles** , **Create role**.

3. Choose **EC2** and then the **EC2** use case. Select **Next: Permissions** .  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1547625013051/360004725314-Screen_Shot_2018-05-05_at_11901160038.41.57_PM.png)  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1547625013051/360004757793-Screen_Shot_2018-05-05_at_11901160041.42.01_PM.png)

4. On the **Attach Policy** page, select **Next: Review** .  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1547625013051/360004725294-Screen_Shot_2018-05-05_at_11901160042.41.46_PM.png)

5. Enter a name for your role; for example 'Flow-Logs-Role' and optionally provide a description. Choose **Create role** .  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1547625013051/360004757813-Screen_Shot_2018-05-05_at_11901160047.41.40_PM.png)

Add Inline Policy via JSON to Permissions
-----------------------------------------

1. Select the name of your role. Under **Permissions** , choose **Add inline policy** .  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1547625013051/360004757833-Screen_Shot_2018-05-05_at_11901160048.44.16_PM.png)

2. Choose the **JSON** tab.

3. Copy the first policy and paste it in the window.

   ```
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Action": [
           "logs:CreateLogGroup",
           "logs:CreateLogStream",
           "logs:PutLogEvents",
           "logs:DescribeLogGroups",
           "logs:DescribeLogStreams"
         ],
         "Effect": "Allow",
         "Resource": "*"
       }
     ]
   }  
   ```

   <br />

   Choose **Review policy**.
4. Enter a name for your policy, and then choose **Create policy** .  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1547625013051/360004725374-Screen_Shot_2018-05-05_at_11901160049.46.10_PM.png)

Edit Trust Relationship and Update Trust Policy
-----------------------------------------------

1. Copy the second policy (the trust relationship), and then choose **Trust relationships** , **Edit trust relationship**. Delete the existing policy document, and paste in the new one.

   ```
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "",
         "Effect": "Allow",
         "Principal": {
           "Service": "vpc-flow-logs.amazonaws.com"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   } 
   ```

   <br />

   When done, click **Update Trust Policy**.

Capture/Note ARN for Newly Created Role
---------------------------------------

1. On the **Summary** page, take note of the ARN for your role. You need this ARN when you create your flow log.

After you've created your IAM role, you can create a Destination Log group for your VPC Flow Logs. For additional information, see [Create a Destination Log Group for VPC Flow Logs in AWS](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144754).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content