VPC Flow Logs
Network-level records of accepted and rejected traffic in your VPC — the forensic and debugging layer that answers 'did the packet even arrive?'
What are VPC Flow Logs?
VPC Flow Logs capture metadata about IP traffic in your VPC — source/destination IPs and ports, protocol, bytes, packet counts, and crucially the ACCEPT/REJECT disposition — at the VPC, subnet, or interface level. They record the shape of traffic, not payloads (that’s not packet capture), delivered to CloudWatch Logs or S3 for querying. They are the network complement to CloudTrail: CloudTrail answers “who called which API?”; Flow Logs answer “did packets flow, and were they allowed?”
The two jobs they do
Debugging connectivity: half of “service A can’t reach service B” tickets resolve here. A REJECT in the logs points at a security group or NACL; an ACCEPT outbound with no corresponding return traffic points at a routing or far-side problem; no log entry at all means the packet never arrived — a route table or gateway issue. This one field triages network problems in minutes that otherwise consume hours. Security forensics and detection: unexpected outbound connections to unknown IPs (exfiltration, C2 callbacks), port-scan patterns, traffic to sanctioned regions, and denied-connection spikes all surface in flow analysis — GuardDuty consumes Flow Logs precisely for this.
Operating them without drowning
Flow Logs are voluminous and billable — logging every interface at full fidelity generates enormous volume and cost. The pragmatic posture: enable at the VPC or key-subnet level, ship to S3 for cheap retention, query with Athena on demand rather than streaming everything through CloudWatch, and use custom log formats to capture only needed fields. Rejected-traffic-only filters cut volume when the goal is security signal over full visibility.
What people get wrong
- Expecting payloads — Flow Logs are metadata; deep inspection needs traffic mirroring, a different (heavier) tool.
- Full-fidelity everywhere and a surprising CloudWatch bill; sample and target instead.
- Storing but never querying: like CloudTrail, unqueried logs are theater — pre-build the Athena queries before the incident.
Primary source: AWS VPC Flow Logs documentation
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.