VPC Flow Logs and Network Monitoring

You cannot secure or optimise what you cannot see. VPC Flow Logs capture metadata about the IP traffic flowing through your network interfaces, subnets, and VPCs. Combined with other AWS monitoring tools, they give you the visibility needed to troubleshoot connectivity issues, detect threats, and meet compliance requirements.

---

What Are VPC Flow Logs?

VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC. Each flow log record describes a network flow — a 5-tuple of source IP, destination IP, source port, destination port, and protocol — over a defined aggregation interval.

Where You Can Enable Flow Logs

Level	What It Captures
VPC	All traffic in the VPC (all subnets, all ENIs)
Subnet	All traffic in a specific subnet
Network Interface (ENI)	Traffic on a single ENI

You can run flow logs at multiple levels simultaneously. Subnet-level or VPC-level logging is most common for broad visibility.

---

Flow Log Record Format

A flow log record contains fields separated by spaces. The default format (Version 2) includes: