Identifying unencrypted network flows using virtual private cloud encryption controls

A computer-implemented method comprising:

• receiving, at a cloud provider network, a request to monitor an encryption state of network traffic associated with a virtual private cloud (VPC) within the cloud provider network;
• obtaining network flow logs generated based on observed network activity involving the VPC;
• determining, based on the network flow logs, that a first traffic flow is unencrypted;
• and
• causing an indication that the first network flow is unencrypted to be presented;
• and
• enabling, by the cloud provider network, an encryption enforcement mechanism for the VPC that prevents configuration changes introducing unencrypted network traffic or otherwise enforces an encryption-in-transit requirement for network traffic associated with the VPC.

A system comprising:

• a first one or more computing devices to implement a data store in a multi-tenant provider network to store network flow logs;
• and
• a second one or more computing devices to implement an encryption control system in the multi-tenant provider network, the encryption control system including instructions that upon execution cause the encryption control system to:
• receive a request to monitor an encryption state of network traffic associated with a virtual private cloud (VPC) within the cloud provider network;
• obtain network flow logs, from the data store, that were generated based on observed network activity involving the VPC;
• determine, based on the network flow logs, that a first traffic flow is unencrypted;
• cause an indication that the first network flow is unencrypted to be presented;
• and
• enable an encryption enforcement mechanism for the VPC that prevents configuration changes introducing unencrypted network traffic or otherwise enforces an encryption-in-transit requirement for network traffic associated with the VPC.