From 32a8271fcdcd2203471d334dc4981eec25a184ad Mon Sep 17 00:00:00 2001
From: Katrin Hoffmann <k.hoffmann@nexus.local>
Date: Thu, 12 Mar 2026 11:00:00 +0000
Subject: [PATCH] Enable VPC flow logs (missed in initial review)

---
 terraform/modules/vpc/main.tf | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/terraform/modules/vpc/main.tf b/terraform/modules/vpc/main.tf
index 34b6d17..8dde403 100644
--- a/terraform/modules/vpc/main.tf
+++ b/terraform/modules/vpc/main.tf
@@ -16,3 +16,11 @@ resource "aws_vpc" "main" {
   enable_dns_support   = true
   tags = { Name = "nexus-${var.environment}", Environment = var.environment }
 }
+
+# Flow logs — added after security review flagged their absence
+resource "aws_flow_log" "main" {
+  vpc_id          = aws_vpc.main.id
+  traffic_type    = "ALL"
+  iam_role_arn    = aws_iam_role.flow_log.arn
+  log_destination = aws_cloudwatch_log_group.flow_log.arn
+}