Logging IP traffic using VPC Flow Logs (original) (raw)

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to the following locations: Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose. The configured delivery path and permissions that enable network traffic logs to be sent to a destination like CloudWatch Logs or S3 are referred to as subscriptions. After you create a flow log, you can retrieve and view the flow log records in the log group, bucket, or delivery stream that you configured.

Flow logs can help you with a number of tasks, such as:

• Diagnosing overly restrictive security group rules
• Monitoring the traffic that is reaching your instance
• Determining the direction of the traffic to and from the network interfaces

Flow log data is collected outside of the path of your network traffic, and therefore does not affect network throughput or latency. You can create or delete flow logs without any risk of impact to network performance.

Contents

• Flow logs basics
• Flow log records
• Flow log record examples
• Flow log limitations
• Pricing
• Work with flow logs
• Publish flow logs to CloudWatch Logs
• Publish flow logs to Amazon S3
• Publish flow logs to Amazon Data Firehose
• Query flow logs using Amazon Athena
• Identity and access management in VPC Flow Logs
• Troubleshoot VPC Flow Logs

Pricing

Data ingestion and archival charges for vended logs apply when you publish flow logs. For more information about pricing when publishing vended logs, open Amazon CloudWatch Pricing, selectLogs and find Vended Logs.

To track charges from publishing flow logs, you can apply cost allocation tags to your destination resource. Thereafter, your AWS cost allocation report includes usage and costs aggregated by these tags. You can apply tags that represent business categories (such as cost centers, application names, or owners) to organize your costs. For more information, see the following:

• Using Cost Allocation Tags in the AWS Billing User Guide
• Tag log groups in Amazon CloudWatch Logs in the Amazon CloudWatch Logs User Guide
• Using cost allocation S3 bucket tags in the Amazon Simple Storage Service User Guide
• Tagging Your Delivery Streams in the Amazon Data Firehose Developer Guide