title: Identifying subnets to enable VPC flowlogs in GCP
body: <p>We need to enable <code>VPC Flow logs</code> in our <code>GCP</code> environment. There are around 100 projects and most of services are using <code>SharedVPC</code> . Each <code>SharedVPC</code> has around three <code>subnets</code> and services in many projects are still running under <code>Default VPC</code> Because there is a cost associated with <code>VPC Flow logs</code> like <code>storage costs</code> and <code>Data access Audit Logs</code> . So our plan is not to enable <code>Flow logs</code>  only on <code>subnets</code> which are Internet facing . But there is nothing like <code>private/public subnet</code> in `GCP'.</p>
  <p>One option we are thinking is like identifying the <code>subnets</code> of GCP services which are exposed to Internet or using <code>Public IP</code> like <code>Google Load Balancer</code> , <code>VM instances with Public IP</code> , <code>GKE LB and Ingress</code> , <code>Cloud SQL instances with Public IP</code> etc and enable <code>VPC Flow Logs</code> on these <code>subnets</code> . But we have to browse through all the projects to identify the subnets for these services which are exposed using <code>Public IP</code>. Does this makes sense ?</p>
  <p>There is also options like increasing the <code>Aggregation internal</code> and <code>sample rate</code> to decrease the cost associated with <code>VPC flow logs</code> but I am looking
  for guidelines and best practices available to identify <code>subnets</code> for enabling <code>VCP flowlogs</code>.</p>