Flow Logs at VPC, Subnet, and ENI Levels

You can enable Flow Logs at three levels: the entire VPC, a single subnet, or one elastic network interface (ENI). The level you choose decides how much traffic is captured and where the visibility focuses. Picking the right scope balances coverage against volume and cost.

A flow log at the VPC level captures traffic for every network interface in every subnet of that VPC, including interfaces created later. This is the broadest coverage and the simplest to manage, since one configuration blankets the whole VPC. It is the usual choice for comprehensive security monitoring.

A subnet-level flow log captures all interfaces within one subnet. This is useful when you want extra detail on a sensitive tier, such as a database subnet, without logging the entire VPC. It narrows the volume while keeping full visibility into that segment of the network.

An ENI-level flow log targets a single network interface, capturing only the traffic for that one resource. This is the most focused scope, ideal for deep monitoring of a specific high-value instance or for an investigation where you want to isolate one workload's connections.

Levels do not override each other; they coexist. New interfaces in a VPC-level log are automatically included as they appear. You can layer a more detailed subnet or ENI log on top of a VPC log if you want both broad coverage and a focused custom format on one area.

For complete security visibility, a VPC-level log is the safest default because it leaves no interface unmonitored, even ones created after setup. Subnet and ENI scopes are additive tools for extra focus, not replacements for broad coverage. The exam favors VPC-level when the goal is "monitor all traffic."

Flow Log volume drives cost and storage. If you only need visibility into one noisy or sensitive tier, a subnet or ENI log captures far less data than logging the whole VPC. When budget or log volume is the constraint, narrowing the scope is the lever to pull.

Each flow log can have its own destination and format. You might send a VPC-level log in default format to S3 for archival, while a subnet-level log on your database tier uses a rich custom format streamed to CloudWatch for real-time alerting. Mixing scopes lets you tailor visibility precisely.

In a multi-account setup, you cannot enable Flow Logs once for the whole organization, but you can enforce them with AWS Config rules or Control Tower guardrails that flag any VPC missing Flow Logs. This ensures every account meets the visibility baseline rather than relying on each team to remember.

To publish to CloudWatch Logs, Flow Logs need an IAM role that grants permission to write to the log group. To publish to S3, the bucket policy must allow the Flow Logs delivery service to write. Getting these permissions right is a common setup gotcha, since a missing role silently breaks delivery.

A strong pattern is a VPC-level log to S3 for cheap, complete archival plus targeted subnet or ENI logs to CloudWatch for the tiers you care about most. This gives you both a full historical record and fast alerting where it counts, all while controlling the cost of the bulk data.

Test your grasp of Flow Log scope.

Flow Logs can be scoped to a VPC, a subnet, or a single ENI, and these scopes coexist. VPC-level gives complete coverage including future interfaces and is the default for full visibility; subnet and ENI scopes reduce volume and focus on sensitive tiers. Each log has its own destination and format, and proper IAM/bucket permissions are required for delivery.