VPC Flow logs

  • Flow log data can be published to Amazon CloudWatch Logs or Amazon S3.
  • Helps to monitor & troubleshoot connectivity issues.
  1. Subnet Flow Logs
  2. Elastic Network Interface Flow Logs
  • Query VPC flow logs using Athena on S3 or CloudWatch Logs Insight.
  • <account-id> — The AWS account ID of the owner of the source network interface for which traffic is recorded.
  • <interface-id> — The ID of the network interface for which the traffic is recorded.
  • <srcaddr> — The source address for incoming traffic.
  • <dstaddr> — The destination address for outgoing traffic.
  • <srcport> — The source port of the traffic.
  • <dstport> — The destination port of the traffic.
  • <protocol> — The IANA protocol number of the traffic
  • <packets> — The number of packets transferred during the flow.
  • <bytes> — The number of bytes transferred during the flow.
  • <start> — The time, in Unix seconds, when the first packet of the flow was received within the aggregation interval.
  • <end> — The time, in Unix seconds, when the last packet of the flow was received within the aggregation interval.
  • <action> The action that is associated with the traffic:

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store