In a Shared VPC where VPC Flow Logs are enabled for Subnet-1 in the host project, you need flow logs for Subnet-2. What should you do?

In a Shared VPC, while the network itself (VPC, subnets, routes, firewalls) is defined in the host project, services and their associated resources (like VMs) reside in service projects. VPC Flow Logs are enabled at the subnet level. Even though the subnet is defined in the host project, when a service project attaches to a Shared VPC, it gains access to use those subnets. To enable flow logs for a specific subnet, you must enable them directly on that subnet, regardless of which project (host or service) is deploying resources into it. Therefore, enabling VPC Flow Logs for Subnet-2 in the service project VPC is the correct action. Adding a filter in the host project is not how flow logs are enabled; filters refine what is logged, not if it's logged. Packet Mirroring is a different network diagnostic tool for capturing full packet data, not flow summaries. Creating a firewall rule is for controlling traffic, not for enabling logging.