So now let's talk about VPC flow logs.
VPC flow logs allow you to capture information
from IP traffic going into your interfaces.
So that could be at the VPC level,
the subnet level,
or the Elastic Network Interface, ENI, level.
So we have three kinds of flow logs.
They're very helpful to monitor
and troubleshoot connectivity issues
happening within your VPC.
So these flow logs can be sent to two destinations.
They can be sent to Amazon S3 and CloudWatch Logs.
And they will capture information
for also AWS managed interfaces,
such as ELB, RDS, ElastiCache, Redshift, WorkSpaces,
your NAT Gateway, your Transit Gateway, and so on.
So in this graph, well, it's very simple,
your flow logs are at the VPC level, for example,
or subnets or ENI level,
and they're sent to CloudWatch and Amazon S3.
So this is what a VPC flow log looks like.
So there is a format associated with it,
but there is the version, account ID, interface ID,
source address, destination address,
source port, destination port, protocol,
packets, bytes, start, end, action, and log status.
So this is metadata about the network packets
going into your VPC.
And you don't need to remember this at a high level, right?
But let's have a look at what information we can get
out of these flow logs.
So the source address and the destination address
help identify problematic IP.
This is where you see if an IP is repeatedly being denied.
Maybe there is something wrong with an IP
or maybe you're being attacked by a specific IP.
Source port and destination port
help you identify the problematic ports.
Action is going to be either accept or reject,
and so it's going to say
whether or not it's a success or failure
at the SG or NACL level.
And we'll see this in the very next slide.
And so this can be used, VPC flow logs,
to do analytics on usage patterns,
or detect managed behavior, port scans, and so on.
Now, to query these flow logs,
you have two ways of doing it.
The best way is to do Athena on S3.
Or if you wanted to do a streaming analysis,
you could use CloudWatch Logs Insights.
So here are some examples that you can have a look
on your own time for flow logs.
So, how do we use flow logs
to troubleshoot Security Group and NACL issues?
Well, we look at the Action field.
So let's have a look at the typical incoming request
for your NACL and your subnet.
So remember, your NACLs are stateless
and your Security Groups are stateful.
So, what happens?
Well, if we get an inbound reject,
so we see that the inbound request
from the outside to our EC2 instance is rejected,
that can mean that either, from this graph,
the NACL is refusing the request
or the Security Group is refusing the request.
And this makes sense, right?
But if we have a inbound accept and an outbound reject,
it can only mean a NACL issue.
Why? Well, because your security group is stateful,
and if the inbound is allowed because of the accept,
automatically the outbound will be allowed
thanks to the statefulness of your Security Group.
So for outgoing requests, similar analysis, right?
This is the diagram we know already.
And so if you got an outbound reject,
then you have a NACL or a Security Group issue.
But if you got an outbound accepted and an inbound reject,
then it must mean a NACL issue.
So let's have a look at a few architectures
for your VPC flow logs.
So they can flow into CloudWatch Logs, as we know.
And then we can use something called
CloudWatch Contributor Insights, for example,
to find the top 10 IP addresses
that contribute to the most amount of network
on your VPC, or on ENI, or whatever you want.
You can also use VPC flow logs
to send them again into CloudWatch Logs.
Here, we can set up a metric filter
to look, for example, for the SSH or the RDP protocols.
And if we realize that there's a lot more SSH
or RDP than usual, then trigger a CloudWatch alarm,
and send an alert into an Amazon SNS topic
because something fishy may be happening on your network.
Or we can use a VPC flow log.
And then we send everything into an S3 bucket for storage.
And we use Amazon Athena to analyze
the VPC flow logs with SQL.
And we can even visualize that with Amazon QuickSight.
So that's it for VPC flow logs.
I hope you liked it.
And I will see you in the next lecture.