Amazon VPC Flow Logs: Traffic Monitoring and Troubleshooting – SAP-C02 Study Guide

Purpose of This Lesson

Amazon VPC Flow Logs provide visibility into IP traffic entering and leaving network interfaces in a VPC. They are useful for troubleshooting connectivity, investigating rejected traffic, validating network behavior, and supporting security analysis.

Flow logs can be created at three scopes:

• VPC level: Captures traffic for network interfaces in the VPC.
• Subnet level: Captures traffic for network interfaces in a specific subnet.
• Network interface level: Captures traffic for one elastic network interface (ENI).

Flow log records can be delivered to Amazon CloudWatch Logs or Amazon S3.

Key Concepts

What VPC Flow Logs Capture

A flow log records metadata about IP traffic rather than packet contents. Typical fields include:

• Source and destination IP addresses
• Source and destination ports
• Protocol
• Number of packets and bytes
• Start and end timestamps
• Traffic action, such as ACCEPT or REJECT
• The network interface associated with the traffic

Flow Logs do not provide packet payload inspection. They indicate that traffic was observed and whether it was accepted or rejected at the relevant network interface, but they do not replace packet capture or application logging.

Flow Log Scope

Flow logs may be created for a VPC, subnet, or ENI. More specific scopes can be useful when investigating one workload without collecting data for the entire environment.

When multiple flow logs apply to the same traffic, AWS may publish records to more than one log destination. Plan scopes carefully to avoid unnecessary duplication and cost.

Traffic Filters

A flow log can capture:

• Accepted traffic only
• Rejected traffic only
• All traffic

Capturing all traffic is useful for broad troubleshooting and baselining. Accepted-only or rejected-only filters can reduce the volume of data when the investigation has a narrower objective.

Aggregation Interval

Flow records are aggregated over a configured interval before being published. The lesson uses a 10-minute maximum aggregation interval. Flow Logs are not a real-time packet monitoring mechanism, so records can appear with a delay and should not be used when immediate detection is required.

CloudWatch Logs Destination

When sending flow logs to CloudWatch Logs, the VPC Flow Logs service needs an IAM role that it can assume. The role requires:

1. A trust policy allowing vpc-flow-logs.amazonaws.com to assume the role.
2. Permissions to create or describe log groups and streams and publish log events.

Typical CloudWatch Logs permissions include:

• logs:CreateLogGroup
• logs:CreateLogStream
• logs:PutLogEvents
• logs:DescribeLogGroups
• logs:DescribeLogStreams

Use a least-privilege policy where practical. An overly broad resource scope may simplify initial setup but is less suitable for production governance.

CloudWatch Logs supports operational workflows such as metric filters, CloudWatch alarms, dashboards, and centralized log analysis. Configure log-group retention explicitly because indefinite retention can create unnecessary storage costs.

Amazon S3 Destination

Amazon S3 is an alternative destination for flow logs. It is often suitable when the organization needs:

• Long-term, lower-cost retention
• Centralized security or network data lakes
• Batch analysis with Amazon Athena
• Integration with other analytics services

For production use, consider S3 encryption, bucket policies, lifecycle rules, access logging or CloudTrail data events where appropriate, and cross-account delivery design.

Log Streams and ENIs

When CloudWatch Logs is used, log streams are associated with the network interfaces generating the records. A stream name commonly includes the ENI identifier. This makes it possible to correlate traffic with a specific resource or network interface.

Exam-Relevant Takeaways

• VPC Flow Logs capture metadata about IP traffic to and from network interfaces.
• Flow Logs can be configured at the VPC, subnet, or ENI level.
• The supported destinations covered here are CloudWatch Logs and Amazon S3.
• CloudWatch Logs delivery requires an IAM role trusted by vpc-flow-logs.amazonaws.com.
• The delivery role needs permissions to create or describe log groups and streams and publish log events.
• Flow Logs can record accepted traffic, rejected traffic, or both.
• Flow Logs are useful for diagnosing security group, network ACL, routing, and reachability issues, but they do not expose packet payloads.
• CloudWatch Logs is convenient for near-operational investigation and alerting; S3 is well suited to durable, economical retention and Athena queries.
• Records are aggregated and delivered asynchronously, so a newly created flow log may not show data immediately.

Architecture Decision Guide

Requirement	Recommended choice	Reason
Investigate traffic for an entire VPC	VPC-level Flow Log	Broad visibility across the VPC
Monitor only workloads in one subnet	Subnet-level Flow Log	Limits collection scope
Troubleshoot one workload or ENI	ENI-level Flow Log	Focused and potentially lower volume
Create operational alerts or dashboards	CloudWatch Logs	Integrates with CloudWatch analysis and alarms
Retain large volumes for later analysis	Amazon S3	Durable storage and lifecycle management
Run SQL queries over historical flow data	Amazon S3 with Athena	Supports serverless query-based analysis
Investigate denied connections	Rejected traffic filter	Reduces noise and focuses on failures
Establish a complete traffic baseline	All traffic filter	Includes accepted and rejected records

Common Exam Traps

• Confusing Flow Logs with packet capture: Flow Logs contain connection metadata, not packet contents.
• Assuming records are immediate: Aggregation and publishing introduce delay.
• Forgetting the IAM trust relationship: The delivery role must trust the VPC Flow Logs service principal.
• Using an EC2 instance role for log delivery: The role used by the Flow Logs service is a service-assumable delivery role, not simply the instance profile attached to an EC2 instance.
• Assuming only VPC-level logging is possible: Subnet- and ENI-level Flow Logs are also supported.
• Treating REJECT as a complete root-cause diagnosis: A rejected record identifies a traffic decision, but further investigation may still be needed across security groups, network ACLs, routing, and the application.
• Ignoring retention costs: CloudWatch Logs retention should be configured deliberately, while S3 lifecycle policies can control long-term storage cost.
• Expecting Flow Logs to prove application health: An accepted network flow does not guarantee that the application responded correctly.

Real-World Engineer Notes

• Start with the narrowest useful scope during an incident, then expand to subnet or VPC scope if the source of the problem is unclear.
• Use consistent log-group naming and tagging so Flow Logs are easy to discover and govern.
• Protect flow-log destinations because network metadata can reveal internal addresses, service relationships, and access patterns.
• For CloudWatch Logs, set retention rather than relying on the default indefinite retention behavior.
• For S3, use lifecycle transitions or expiration rules when historical data does not need to remain in the most expensive storage class.
• Centralized logging architectures may deliver logs to a security or networking account. In that design, account-level IAM, S3 bucket policies, encryption keys, and organization-wide governance must be planned together.
• When troubleshooting a connection, correlate Flow Logs with route tables, security groups, network ACLs, NAT gateways, load balancer logs, and application logs. Flow Logs are one layer of evidence rather than a complete diagnosis.

Quick Reference Summary

• Purpose: Observe IP traffic metadata for VPC networking and security analysis.
• Scopes: VPC, subnet, or ENI.
• Filters: Accepted, rejected, or all traffic.
• Destinations: CloudWatch Logs or Amazon S3.
• CloudWatch requirement: IAM role trusted by vpc-flow-logs.amazonaws.com with log delivery permissions.
• Typical fields: Source/destination IP and ports, protocol, bytes, packets, timestamps, action, and ENI.
• Important limitation: No packet payloads and no guaranteed real-time delivery.
• CloudWatch strength: Investigation, dashboards, and alerting.
• S3 strength: Long-term retention and Athena-based analysis.

Flashcards

1. Q: What does Amazon VPC Flow Logs capture?

A: Metadata about IP traffic going to and from network interfaces, including addresses, ports, protocol, volume, timestamps, and traffic action.

1. Q: At what levels can VPC Flow Logs be created?

A: VPC, subnet, and network interface levels.

1. Q: Which destinations can receive VPC Flow Logs?

A: Amazon CloudWatch Logs and Amazon S3.

1. Q: Which service principal must a CloudWatch delivery role trust?

A: vpc-flow-logs.amazonaws.com.

1. Q: What is the purpose of logs:PutLogEvents?

A: It permits publishing log records to a CloudWatch Logs stream.

1. Q: What traffic filters are available for Flow Logs?

A: Accepted traffic, rejected traffic, or all traffic.

1. Q: Does a Flow Log contain packet payload data?

A: No. It contains traffic metadata, not packet contents.

1. Q: Why might a new flow log have no records immediately after creation?

A: Records are aggregated and delivered asynchronously, and there may not yet be relevant traffic to publish.

1. Q: When is S3 often preferable to CloudWatch Logs?

A: For economical long-term retention, centralized data-lake storage, and Athena-based analysis.

1. Q: What does an ENI-based CloudWatch log stream help identify?

A: The network interface associated with the observed traffic.

1. Q: Can an accepted Flow Log record prove that an application request succeeded?

A: No. It only provides network-level metadata; application and response health require additional logs and metrics.

1. Q: Why configure CloudWatch Logs retention for Flow Logs?

A: To prevent unnecessary indefinite storage and control cost and data-retention risk.

Practice Questions

Question 1

A security team wants to investigate rejected connections across every subnet in a VPC. They need the records available for CloudWatch analysis and want to minimize unrelated traffic. Which configuration best meets the requirement?

A. Create an ENI-level Flow Log for one instance and capture accepted traffic only.

B. Create a subnet-level Flow Log for every subnet and capture all traffic to Amazon S3.

C. Create a VPC-level Flow Log with a rejected-traffic filter and deliver it to CloudWatch Logs.

D. Enable VPC Flow Logs and send them directly to an EC2 instance.

Correct answer: C

Explanation: A VPC-level Flow Log covers all relevant interfaces, the rejected filter focuses on the security investigation, and CloudWatch Logs supports operational analysis. Flow Logs do not deliver directly to an EC2 instance.

Question 2

An administrator attempts to create a VPC Flow Log targeting CloudWatch Logs, but AWS rejects the configuration because the delivery role cannot be assumed. What is the most likely issue?

A. The EC2 instance lacks a public IPv4 address.

B. The IAM role trust policy does not trust vpc-flow-logs.amazonaws.com.

C. The VPC has no internet gateway.

D. The destination must be an S3 bucket.

Correct answer: B

Explanation: The VPC Flow Logs service must be able to assume the IAM delivery role. The role’s trust policy must include the VPC Flow Logs service principal.

Question 3

A company needs to retain VPC traffic metadata for several years and periodically run SQL queries to investigate historical communication patterns. Which design is most appropriate?

A. Store the data only in an instance’s local filesystem.

B. Deliver the Flow Logs to S3 and query them with Amazon Athena.

C. Use an ENI-level Flow Log and disable retention after one day.

D. Send the records to an EC2 security group.

Correct answer: B

Explanation: S3 provides durable, scalable storage with lifecycle controls, and Athena can query data in S3 using SQL without requiring a dedicated database server.

Question 4

A network engineer sees a REJECT record for traffic from an application instance to a database address. What is the best next step?

A. Conclude that the database is offline.

B. Replace the VPC Flow Log with packet capture immediately.

C. Correlate the record with security groups, network ACLs, route tables, and database/application logs.

D. Add an internet gateway to the database subnet.

Correct answer: C

Explanation: A rejected flow indicates a network traffic decision but does not identify every possible cause or prove that the database is offline. The surrounding network and application configuration must be checked.

Question 5

A team wants to monitor one problematic workload without creating a high-volume VPC-wide log stream during the initial investigation. Which scope should it consider first?

A. The entire AWS Region

B. The workload’s network interface

C. Every VPC in the organization

D. An internet gateway

Correct answer: B

Explanation: An ENI-level Flow Log provides focused visibility for a specific workload and can reduce unrelated records while the investigation begins.