⭐⭐⭐ Network Troubleshooting
🌊 VPC Flow Logs
VPC Flow Logs capture information about IP traffic going to and from network interfaces in your VPC. They're the primary tool for troubleshooting network connectivity issues in AWS.
🔑 Covers: What Flow Logs Capture · Log Format · Network Troubleshooting · Security AnalysisWhat are VPC Flow Logs?
VPC Flow Logs
A feature that captures metadata about IP traffic flowing through your VPC network interfaces. For every connection attempt, it records: source IP, destination IP, source port, destination port, protocol, bytes transferred, packets, and whether the traffic was ACCEPTED or REJECTED. Think of it like a security camera for your network — it records all traffic at the IP level.
📊 Flow Log Record Format
VPC Flow Log Record
# Fields: version accountid interfaceid srcaddr dstaddr srcport dstport protocol packets bytes start end action logstatus
2 123456789012 eni-abc12345 10.0.1.5 10.0.2.10 49322 443 6 10 4800 1620000000 1620000060 ACCEPT OK
2 123456789012 eni-abc12345 10.0.1.5 10.0.3.20 52741 3306 6 0 0 1620000000 1620000060 REJECT OK
# First record: EC2 instance (10.0.1.5) connected to 10.0.2.10:443 (HTTPS) — ACCEPTED
# Second record: EC2 instance tried to connect to 10.0.3.20:3306 (MySQL) — REJECTED by security group/NACL
🎯 Key Use Cases
🔧 Connectivity Troubleshooting
"Why can't EC2 instance A reach RDS instance B?" → Look for REJECT records between their IPs. Tells you a security group or NACL is blocking the traffic.
🔐 Security Analysis
Detect port scanning, unusual connection patterns, data exfiltration (large outbound traffic), access from unexpected IPs.
📊 Traffic Analysis
Understand traffic patterns, find top talkers, identify bandwidth consumption. Useful for capacity planning and cost optimization.
📍 Where to Enable Flow Logs
- VPC level: Captures traffic for all interfaces in the VPC
- Subnet level: Captures traffic for all interfaces in the subnet
- Network Interface level: Captures traffic for one specific ENI
💾 Where Do Flow Logs Go?
- CloudWatch Logs: For real-time analysis with Logs Insights queries
- S3 bucket: For long-term storage + Athena SQL queries
- Kinesis Data Firehose: For real-time streaming to OpenSearch or other destinations
🎯 Exam Tip
VPC Flow Logs answer NETWORK questions: "Why is EC2 not reaching database?", "Is traffic being blocked?", "What IP addresses are connecting to my server?". They do NOT show the application payload (no HTTP headers, no request body) — just IP-level metadata (source/dest IP, port, protocol, accept/reject). For application-level issues, use CloudWatch Logs.