diff --git a/terraform/main.tf b/terraform/main.tf
index 1bf66773f5..2e9d40ac17 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -5,19 +5,26 @@ module "vpc" {
   name = var.vpc.name
   cidr = var.vpc.cidr
 
-  azs                                   = var.vpc.azs
-  private_subnets                       = var.vpc.private_subnets
-  public_subnets                        = var.vpc.public_subnets
-  database_subnets                      = var.vpc.database_subnets
-  elasticache_subnets                   = var.vpc.elasticache_subnets
-  create_database_subnet_group          = var.vpc.create_database_subnet_group
-  create_database_subnet_route_table    = var.vpc.create_database_subnet_route_table
-  create_elasticache_subnet_group       = var.vpc.create_elasticache_subnet_group
-  create_elasticache_subnet_route_table = var.vpc.create_elasticache_subnet_route_table
-  enable_vpn_gateway                    = var.vpc.enable_vpn_gateway
-  one_nat_gateway_per_az                = var.vpc.one_nat_gateway_per_az
-  single_nat_gateway                    = var.vpc.single_nat_gateway
-  enable_nat_gateway                    = var.vpc.enable_nat_gateway
+  azs                                       = var.vpc.azs
+  private_subnets                           = var.vpc.private_subnets
+  public_subnets                            = var.vpc.public_subnets
+  database_subnets                          = var.vpc.database_subnets
+  elasticache_subnets                       = var.vpc.elasticache_subnets
+  create_database_subnet_group              = var.vpc.create_database_subnet_group
+  create_database_subnet_route_table        = var.vpc.create_database_subnet_route_table
+  create_elasticache_subnet_group           = var.vpc.create_elasticache_subnet_group
+  create_elasticache_subnet_route_table     = var.vpc.create_elasticache_subnet_route_table
+  enable_vpn_gateway                        = var.vpc.enable_vpn_gateway
+  one_nat_gateway_per_az                    = var.vpc.one_nat_gateway_per_az
+  single_nat_gateway                        = var.vpc.single_nat_gateway
+  enable_nat_gateway                        = var.vpc.enable_nat_gateway
+  enable_flow_log                           = var.vpc.enable_flow_log
+  create_flow_log_cloudwatch_log_group      = var.vpc.create_flow_log_cloudwatch_log_group
+  create_flow_log_cloudwatch_iam_role       = var.vpc.create_flow_log_cloudwatch_iam_role
+  flow_log_max_aggregation_interval         = var.vpc.flow_log_max_aggregation_interval
+  flow_log_cloudwatch_log_group_name_prefix = var.vpc.flow_log_cloudwatch_log_group_name_prefix
+  flow_log_cloudwatch_log_group_name_suffix = var.vpc.flow_log_cloudwatch_log_group_name_suffix
+  vpc_flow_log_tags                         = var.vpc.vpc_flow_log_tags
 }
 
 module "byo-vpc" {
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 1120d65dfa..c4a90fc5bb 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -16,6 +16,14 @@ variable "vpc" {
     one_nat_gateway_per_az                = optional(bool, false)
     single_nat_gateway                    = optional(bool, true)
     enable_nat_gateway                    = optional(bool, true)
+
+    enable_flow_log                           = optional(bool, false)
+    create_flow_log_cloudwatch_log_group      = optional(bool, false)
+    create_flow_log_cloudwatch_iam_role       = optional(bool, false)
+    flow_log_max_aggregation_interval         = optional(number, 600)
+    flow_log_cloudwatch_log_group_name_prefix = optional(string, "/aws/vpc-flow-log/")
+    flow_log_cloudwatch_log_group_name_suffix = optional(string, "")
+    vpc_flow_log_tags                         = optional(map(string), {})
   })
   default = {
     name                = "fleet"
@@ -34,6 +42,14 @@ variable "vpc" {
     one_nat_gateway_per_az                = false
     single_nat_gateway                    = true
     enable_nat_gateway                    = true
+
+    enable_flow_log                           = false
+    create_flow_log_cloudwatch_log_group      = false
+    create_flow_log_cloudwatch_iam_role       = false
+    flow_log_max_aggregation_interval         = 600
+    flow_log_cloudwatch_log_group_name_prefix = "/aws/vpc-flow-log/"
+    flow_log_cloudwatch_log_group_name_suffix = ""
+    vpc_flow_log_tags                         = {}
   }
 }