Diagnosing Connectivity with VPC Flow Logs

VPC Flow Logs capture metadata about the IP traffic going to and from network interfaces in your VPC — source/destination IP and port, protocol, byte counts, and critically, whether the traffic was ACCEPTED or REJECTED at that interface. They can be enabled at the VPC, subnet, or individual network interface level, and sent to CloudWatch Logs or S3 for analysis.

When diagnosing 'why can't service A reach service B,' flow logs answer a question that Security Group and NACL configuration review alone cannot: did the traffic actually arrive, and what happened to it. A REJECT entry immediately tells you a Security Group or NACL is blocking the traffic (and flow logs indicate which type of rule caused the rejection); the complete absence of any log entry for that traffic tells you it never arrived at all — pointing you toward a routing problem (missing route, wrong target) rather than a firewall rule problem.

Flow logs don't capture the actual packet contents (no payload data), only metadata — so they're for diagnosing connectivity and traffic patterns, not for deep packet inspection or content-level debugging, which would require a different tool (like VPC Traffic Mirroring) entirely.