VPC Flow Logs

VPC Flow Logs capture information about IP traffic flowing through your VPC's network interfaces. Each flow log record includes source/destination IP, ports, protocol, packet count, byte count, and whether the traffic was accepted or rejected.

Use Cases

• Detect unusual network patterns (data exfiltration, lateral movement)
• Troubleshoot connectivity issues (rejected traffic)
• Verify security group and NACL rules are working
• Feed into GuardDuty for threat detection
• Compliance evidence for network monitoring requirements

How Flow Logs Work

You create a flow log at the VPC, subnet, or network interface level, and publish records to one of three destinations: Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose. Collection happens outside the traffic path, so flow logs add no latency and no throughput penalty; you can create and delete them freely without touching performance. Records are aggregated over an interval of either 60 or 600 seconds before delivery (on Nitro-based instances the interval is always one minute or less regardless of the setting), which makes flow logs a near-real-time signal, not a live packet capture.

One operational constraint matters more than any other: a flow log configuration is immutable after creation. You cannot change its IAM role, destination, or record format later; the documented approach is to delete the flow log and create a new one. Design your log format up front, and consider including fields like pkt-srcaddr and pkt-dstaddr, which preserve original addresses in flows that traverse intermediate interfaces.

Choosing a Destination

The destination decides what analysis costs you later. CloudWatch Logs suits interactive investigation and metric filters but is the priciest place to keep high-volume flow data. S3 is the archival default, and AWS documents querying flow logs there with Amazon Athena, which turns months of records into SQL questions like "which interfaces sent the most bytes to this CIDR last week". Data Firehose fits when the records feed an external SIEM. Note the scale guardrails: flow logs support a maximum of 250 subscriptions per resource per account, and you cannot enable flow logs on a peered VPC unless that VPC lives in your own account.

How It Goes Wrong in Practice

The dangerous mistake is treating flow logs as a complete record of network activity, because several traffic classes are explicitly not logged:

• Traffic to and from 169.254.169.254, the instance metadata service. Credential theft via the metadata endpoint leaves no trace in flow logs.
• Traffic to the Amazon DNS resolver. DNS-based exfiltration through the default resolver is invisible here; you need Route 53 Resolver query logging (or GuardDuty, which analyzes DNS through its own stream) for that.
• DHCP traffic, ARP traffic, Amazon Time Sync traffic (169.254.169.123), Windows license activation traffic, and traffic to the default VPC router's reserved address.

An investigation that relies on flow logs alone will therefore miss exactly the techniques attackers favor for credential access and quiet exfiltration. Flow logs also record metadata only, never payloads, so they tell you that two hosts exchanged 40 MB on port 443, not what the bytes were. Pair them with CloudTrail, DNS query logs, and GuardDuty rather than treating them as a standalone detection layer.

Practical Check: Verify Coverage and Delivery

Confirm a VPC actually has an active flow log, and that delivery is not silently failing:

aws ec2 describe-flow-logs --filter Name=resource-id,Values=vpc-0123456789abcdef0

Check three output fields: FlowLogStatus should be ACTIVE, DeliverLogsStatus should be SUCCESS (a FAILED status usually means a broken IAM role or destination permissions), and TrafficType tells you whether you are capturing ACCEPT, REJECT, or ALL traffic. An empty result means the VPC has no flow log at all, which is worth flagging in any environment claiming network monitoring for compliance.

Frequently Asked Questions

Are VPC Flow Logs real time?

No. Records are aggregated over a 60 or 600 second interval and then delivered to your destination, so expect minutes of end-to-end delay. That is fast enough for detection pipelines and far too slow for inline blocking decisions.

Do flow logs capture packet contents?

No, only flow metadata: addresses, ports, protocol, byte and packet counts, action, and optional extended fields. If you need payload-level visibility, that is what VPC Traffic Mirroring and inspection appliances are for.

Can I add fields to an existing flow log?

No. The record format is fixed at creation. Create a new flow log with the desired format alongside the old one, confirm delivery, then delete the old one. Multiple flow logs can coexist on the same resource, which makes this migration safe.