VPC Flow Logs capture metadata about ALL IP traffic flowing through your VPC, subnets, and network interfaces. They are essential for security analysis, compliance, and network troubleshooting.
Version AccountID InterfaceID SrcAddr DstAddr SrcPort DstPort Protocol Packets Bytes StartTime EndTime Action
2 123456789012 eni-1234567890 10.0.1.15 52.0.0.1 45678 443 6 20 4000 1725000000 1725000060 ACCEPT
2 123456789012 eni-1234567890 203.0.113.5 10.0.1.15 1234 22 6 5 240 1725000000 1725000010 REJECT
Action ACCEPT = traffic was allowed by security group/NACL
Action REJECT = traffic was blocked
Protocol 6 = TCP, 17 = UDP, 1 = ICMP| Destination | Use Case | Query Method |
|---|---|---|
| CloudWatch Logs | Real-time analysis, alerting | CloudWatch Logs Insights |
| S3 | Long-term storage, compliance | Athena SQL queries |
| Kinesis Data Firehose | Stream to OpenSearch or Splunk | Third-party SIEM tools |
# Find rejected connections (potential attack attempts)
SELECT srcaddr, COUNT(*) as attempts
FROM vpc_flow_logs
WHERE action = 'REJECT'
GROUP BY srcaddr
ORDER BY attempts DESC
LIMIT 10
-- Running in Athena on flow logs stored in S3
# Find unusual outbound traffic (potential data exfiltration)
SELECT dstaddr, SUM(bytes) as total_bytes
FROM vpc_flow_logs
WHERE direction = 'egress'
AND bytes > 10000000 -- over 10MB
GROUP BY dstaddr
ORDER BY total_bytes DESC