Record every flow through your VPC as a one-line record

Record format

Start with the default format; add the fields you need with a custom format

The default format uses the 14 version 2 fields in a fixed order. A custom format picks only the fields you want, in the order you want, and the record's version becomes the highest version among the chosen fields. The format can't be changed after creation; to change it, create a new flow log.

${version} ${interface-id} ${instance-id} ${srcaddr} ${dstaddr}
${pkt-srcaddr} ${pkt-dstaddr} ${flow-direction} ${traffic-path}
${tcp-flags} ${action}

5 eni-0nat0123456789abc - 10.0.1.25 10.0.0.15 10.0.1.25 198.51.100.10 ingress - 2 ACCEPT

# dstaddr     = private IP of the NAT gateway ENI
# pkt-dstaddr = actual packet destination (internet peer)
# instance-id = '-' (requester-managed ENI)
# tcp-flags 2 = SYN; traffic-path is populated only in egress records

Features

Main features

Destinations

Comparing destinations

You can create several flow logs with different destinations and formats on the same resource. CloudWatch Logs suits immediate queries and alarms, S3 suits long-term retention and bulk analysis, and Firehose suits streaming to external tools.

Reference architecture

Three stages: capture, delivery, analysis

Flow Logs collects flow metadata from ENIs and transit gateways outside the traffic path, groups it into records every aggregation interval, and delivers them to destinations. Because each destination uses different analysis tools, it's common to create separate flow logs per purpose. To check statically whether the path itself is configured as intended, use Reachability Analyzer.

Getting started

Steps to turn on your first flow log

1. STEP 1

   Scope and traffic type

   Choose a target among VPC, subnet, ENI, TGW, and regional NAT, and decide on ACCEPT, REJECT, or ALL. VPC overview

2. STEP 2

   Prepare the destination

   Prepare a log group and IAM role, or an S3 bucket policy or Firehose stream.

3. STEP 3

   Format and aggregation interval

   Choose default or custom format, a 1- or 10-minute interval, and for S3, Parquet and Hive partitions.

4. STEP 4

   Create the flow log

   Create it in the console or with aws ec2 create-flow-logs and add tags.

5. STEP 5

   Verify with queries

   Once records accumulate after a few minutes, check the top REJECT flows first with Logs Insights or Athena.

Pricing

Cost components

Flow Logs has no separate hourly charge; the log data it generates is billed at CloudWatch vended logs rates. Rates differ by destination and are tiered, decreasing as usage grows.

Log volume scales with the number of flows, the aggregation interval, and the number of fields chosen more than with traffic volume. Logging only REJECT or choosing only the fields you need reduces cost. Add cost allocation tags to destination resources (log groups, buckets, Firehose streams) to split flow log charges by team. See Vended Logs on the Amazon CloudWatch pricing page for current rates.