VPC Flow Logs

Question 1

What are VPC Flowlogs?

Answer 1

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs or Amazon S3.

Question 2

Name the three levels that Flow Logs can be created at?

Answer 2

1. VPC
2. Subnet
3. Network Interface Level

Question 3

Name the VPC Flow Log Exam Tips

Answer 3

1. You cannot enable flow logs for VPCs that are peered with your VPC unless the peer VPC is in your accounts.
2. You can tag flow logs.
3. After you’ve created a flow log, you cannot change it’s config; for example, you can’t associate a different IAM role with the flow log.
4. Not all IP traffic is monitored. These are not monitored…
   - Traffic generated by instances when they contact Amazon DNS sever. If you use your own DNS server, then all traffic to that DNS server is logged.
   - Traffic generated by a Windows instance for Amazon Windoes Licence activation.
   - Traffic to and from 169.245.169.254 for instance metadata
   - DHCP traffic