What VPC Flow Logs Capture

VPC Flow Logs capture metadata about the IP traffic flowing to and from network interfaces in your Virtual Private Cloud (VPC). They record information about connections, giving security teams visibility into who talked to whom, on which ports, and whether the traffic was allowed or blocked.

A crucial point: Flow Logs record connection metadata only, never the actual packet contents. You see source and destination IPs, ports, protocol, byte and packet counts, and the action taken. You do not see the data inside the packets. For payload inspection you need VPC Traffic Mirroring instead.

Network metadata reveals patterns attackers cannot easily hide: a host scanning many ports, large outbound transfers suggesting exfiltration, or connections to known-bad IPs. Flow Logs provide the raw evidence to spot these and to reconstruct what a compromised instance was talking to during an incident.

Each flow log record includes an action of ACCEPT or REJECT, reflecting whether security groups and network ACLs permitted the traffic. Watching REJECTs reveals attempted connections that were blocked, useful for spotting probing. Reviewing ACCEPTs confirms what actually got through, which matters most during an investigation.

Flow Logs can be delivered to three destinations: CloudWatch Logs for alerting and Insights queries, Amazon S3 for cheap archival and Athena analysis, or Amazon Kinesis Data Firehose for streaming to other systems. The destination you pick depends on whether you need real-time alerting or large-scale querying.

Enabling Flow Logs is passive: it has no impact on network performance or throughput and does not change whether traffic is allowed. It is pure observation. This makes it safe to enable broadly, and the exam expects you to know it is a monitoring tool, not an enforcement control.

Some traffic is excluded by design, such as traffic to Amazon DNS, Windows license activation, instance metadata at 169.254.169.254, and DHCP. Knowing these gaps prevents false conclusions during an investigation, since their absence in the logs is expected rather than suspicious.

You can choose the default format or a custom format that adds fields like the VPC ID, subnet ID, instance ID, TCP flags, and traffic path. Richer fields make queries far more useful, letting you pivot directly from a flow to the exact instance and subnet involved without extra lookups.

Flow Logs aggregate traffic over an aggregation interval, either ten minutes or one minute. A shorter interval gives faster visibility for detection at higher log volume and cost. For security monitoring the one-minute interval is often worth it to shrink the gap between an event and seeing it.

Flow Logs are also a behind-the-scenes data source for GuardDuty, which analyzes them for threats without you managing the pipeline. You can still enable your own Flow Logs for raw evidence and custom queries. Together they give both managed detection and the underlying data for deep investigation.

Flow Logs answer "what connected to what" across your VPC. They are passive, metadata-only, and flexible in destination. Pair them with security groups and NACLs for enforcement, GuardDuty for detection, and Athena for analysis. They are a cornerstone of network visibility in the AWS security toolkit.

Test your understanding of what Flow Logs capture.

VPC Flow Logs record connection metadata (IPs, ports, protocol, bytes, and an ACCEPT/REJECT action) but never packet payloads. They are passive with no performance impact and can deliver to CloudWatch Logs, S3, or Kinesis Firehose. Custom formats add useful fields, the aggregation interval can be one minute, and the data also feeds GuardDuty.