What is a VPC flow log in AWS?

An AWS VPC flow log captures information about the IP traffic going to and from network interfaces in your VPC. Flow logs can help you monitor network traffic, diagnose overly restrictive security group rules, and detect unusual traffic patterns for security analysis.

How do I create a VPC flow log and save it to AWS S3?

To create a VPC flow log saved to S3, go to the VPC console, select your VPC, click 'Actions' then 'Create flow log', choose S3 as the destination, provide the S3 bucket ARN, select the traffic type (All, Accept, or Reject), and click Create. Ensure your S3 bucket policy allows flow log delivery.

How much does VPC flow logging cost in AWS?

VPC flow log costs include CloudWatch Logs ingestion charges (if using CloudWatch) or S3 storage charges (if using S3). With S3, you pay standard S3 storage and data transfer rates. There are also data ingestion charges per GB of log data published. Using S3 is generally more cost-effective than CloudWatch for long-term storage.

How can I query VPC flow logs stored in S3?

VPC flow logs stored in S3 can be queried using Amazon Athena by creating an external table over the S3 location and running SQL queries. You can also use Amazon OpenSearch Service or process logs with AWS Glue ETL jobs for analytics and security monitoring.

How to Create AWS VPC Flow Logs & Save to S3

September 14, 2020 / Nirav Shah

How to Create VPC Flow Logs and Save Them to AWS S3

What Are VPC Flow Logs? Definition & Key Use Cases

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces within your VPC. Flow log data is then stored using Amazon CloudWatch Logs. And after you’ve created a flow log, you can view and retrieve its log data in Amazon CloudWatch.

Step-by-Step: Creating and Publishing VPC Flow Logs to AWS S3

VPC level
Subnet level
Network interface level

How to create flow log?

Step 1

Step 2

Go to the VPC section and click on “Action” and create flow log.

There are two types of destination

Send to cloud watch log
Send to s3 bucket
Network interface level

Create flow logs aws s3

For the “Destination log group” you have to create a cloud watch log. If you don’t know how to create a cloud watch log, this Visit Amazon Cloudwatch Logs Guidelines will help you.

Destination log group

Now if you click on “Send to an S3 bucket” you will see a screen as shown below.

Publish VPC flow logs to aws s3

If you have already created a bucket, then add the bucket ARN in the above section. After filling up information in all the above fields, just click on “create” button.

It can take around 10 minutes to add a log on the s3 bucket.

So that’s it for today’s blog please go to your s3 bucket and check the logs.

Also Read : VPC Endpoints with S3

FAQs:

1. How do I collect VPC flow logs?

2. Are CloudWatch logs stored in S3?

3. how to enable vpc flow logs in aws

Spread Love By Sharing:

Nirav Shah

Nirav Shah is the Director of Eternal Web Pvt Ltd, an AWS Advanced Consulting Partner and certified Odoo Partner based in the UK. With over a decade of experience in cloud computing, digital transformation, and ERP implementation, Nirav helps enterprises adopt the right technology to solve complex business challenges. He specialises in AWS infrastructure, Odoo ERP, and web development solutions for businesses across the UK and beyond.