VPC Flow Logs: the record of what actually happened

Speaker notes

• VPC Flow Logs capture metadata about IP traffic, source/destination IP and port, protocol, byte counts, and crucially whether the traffic was ACCEPTed or REJECTed, at the ENI, subnet, or entire VPC level. They capture metadata only, never packet payload, which is exactly why they're safe to enable broadly without becoming a data-exfiltration risk in themselves.
• Flow Logs can be delivered to CloudWatch Logs (for real-time querying and alerting), S3 (for cost-effective long-term retention and Athena-based analysis), or Kinesis Data Firehose (for streaming to a third-party SIEM). The destination choice is a genuine architectural decision, not just a preference: CloudWatch Logs costs more per GB but supports live alerting, S3 is cheap at rest but requires a separate query step.
• The REJECTed-traffic field is the actual diagnostic gold: when a connection mysteriously doesn't work, filtering Flow Logs for REJECT entries between the specific source and destination tells you definitively whether a Security Group or NACL is the blocker, without guessing, and without needing Reachability Analyzer's more heavyweight configuration analysis for what's often a five-minute log query.

Deck map