What's changed: In-scope coverage: added ops/notification/governance (EventBridge/SNS/SQS/Health Dashboard/Trusted Advisor/Well-Architected/Management Console/Control Tower)
5.1Visibility with VPC Flow Logs
See your traffic—understand VPC Flow Logs, capture scope (VPC/subnet/ENI), ACCEPT/REJECT, destinations (CloudWatch/S3), and how they differ from Traffic Mirroring.
VPC Flow Logs record metadata about traffic through network interfaces (ENIs)—source/destination IP, ports, accept/reject—but not the packet contents.
5.1.1Scope and destinations
- Scope: enable at the VPC, subnet, or ENI level. Can record both ACCEPT and REJECT.
- Contents: metadata such as source/destination IP, port, protocol, bytes, and accept/reject.
- Destinations: CloudWatch Logs (alarms/Logs Insights) or S3 (query with Athena).
- If you need packet contents: not via flow logs. Use Traffic Mirroring to capture actual packets.
Common on ANS-C01: see accepted/rejected traffic = VPC Flow Logs (metadata), packet contents = Traffic Mirroring, and output to CloudWatch Logs or S3 (Athena). A common trap: flow logs do not include packet contents.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.