7.7 VPC Flow Logs

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow Logs data is stored using Amazon CloudWatch Logs. After you have created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is a way of tracking all the network traffic to and from in your VPC.

Flow logs can be created at 3 levels:

VPC - If we do flow log in this level, it will capture all traffic within our VPC.
Subnet - If we do flow log in this level, it will capture the traffic of the instances in the subnet.
Network Interface Level.

Steps:

Go to VPC, go to Your VPC, select your customized VPC. Go to Actions -> Create Flow Log.
For the filter, the filter specify the type of traffic to be logged: accepted, rejected, or all.
For the role, click Set Up Permissions. Then a IAM role (FlowLogsRole) will be loaded up, and then Click Allow. Basically this role is allowing our flow logs to log to CloudWatch. Back to Create Flow Log, and for the role now select FlowLogsRole.
The ARN is also shown.
For the destination log group, we need to create a new log group in the CloudWatch. So go to CloudWatch dashboard, go to Logs, click create log group (MyCustomVPCFlowLog). Back to Create Flow Log, for the destination log group, select MyCustomVPCFlowLog.
Click Create Flow Log. That's it.
You can also go to CloudWatch -> Logs, select a log group, and click Actions -> Stream to AWS Lambda or Stream to Amazon ElasticSearch Service. If you are streaming it to Lambda, you could have your environment proactively react to something that going on inside your VPC or someone is going to potentially attacking your EC2 instance or Elastic Network Interfaces (ENI). You can also export data to Amazon S3 as well.

Exam Tips:

You cannot enable flow logs for VPCs that are peered with your VPC unless the peer VPC is in your account.
You cannot tag a flow log.
After you have created a flow log, you cannot change its configuration; for example, you cannot associate a different IAM role with the flow log.
Not all IP traffic is monitored:
- Traffic generated by instance when they contact the Amazon DNS server, If you use your own DNS server, then all traffic to that DNS server is logged.
- Traffic generated by a Windows instance for Amazon Windows license activation.
- Traffic to and from 169.254.169.254 for instance metadata.
- DHCP traffic.
- Traffic to the reserved IP address for the default VPC router.

Previous7.6 Load Balancers & Custom VPCs Next7.8 NATs vs. Bastions

Last updated 5 years ago

Was this helpful?

Steps:

Go to VPC, go to Your VPC, select your customized VPC. Go to Actions -> Create Flow Log.

For the filter, the filter specify the type of traffic to be logged: accepted, rejected, or all.

For the role, click Set Up Permissions. Then a IAM role (FlowLogsRole) will be loaded up, and then Click Allow. Basically this role is allowing our flow logs to log to CloudWatch. Back to Create Flow Log, and for the role now select FlowLogsRole.

The ARN is also shown.

For the destination log group, we need to create a new log group in the CloudWatch. So go to CloudWatch dashboard, go to Logs, click create log group (MyCustomVPCFlowLog). Back to Create Flow Log, for the destination log group, select MyCustomVPCFlowLog.

Click Create Flow Log. That's it.

You can also go to CloudWatch -> Logs, select a log group, and click Actions -> Stream to AWS Lambda or Stream to Amazon ElasticSearch Service. If you are streaming it to Lambda, you could have your environment proactively react to something that going on inside your VPC or someone is going to potentially attacking your EC2 instance or Elastic Network Interfaces (ENI). You can also export data to Amazon S3 as well.

Exam Tips:

You cannot enable flow logs for VPCs that are peered with your VPC unless the peer VPC is in your account.

You cannot tag a flow log.

After you have created a flow log, you cannot change its configuration; for example, you cannot associate a different IAM role with the flow log.

Not all IP traffic is monitored:

Traffic generated by instance when they contact the Amazon DNS server, If you use your own DNS server, then all traffic to that DNS server is logged.
Traffic generated by a Windows instance for Amazon Windows license activation.
Traffic to and from 169.254.169.254 for instance metadata.
DHCP traffic.
Traffic to the reserved IP address for the default VPC router.