Skip to content

Latest commit

 

History

History
34 lines (31 loc) · 799 Bytes

VPC_Flow_Logs.md

File metadata and controls

34 lines (31 loc) · 799 Bytes

VPC Flow Logs

  • Return to table of contents

  • Useful Links:

  • Exam Tips:

    • Flow Logs only provide access to the traffic metadata, not the actual IP traffic itself.
    • What is logged:
      • Default format:
        • version
        • account-id
        • interface-id
        • srcaddr
        • dstaddr
        • srcport
        • dstport
        • protocol
        • packets
        • bytes
        • start
        • end
        • action
        • log-status
    • What isn't logged:
      • DHCP.
      • AWS DNS.
      • Metadata.
      • License Activation Requests.
    • Destinations:
      • CWLogs.
      • S3 Buckets.
    • Possible misaligned NACL and security groups, if you see multiple accept and reject entries.