Diagnosing Connectivity with VPC Flow Logs
~8 min read
The definitive source of truth for whether traffic reached a network interface and whether it was allowed or blocked.
Diagnosing Connectivity with VPC Flow Logs is a Pro topic
Sign in, then upgrade to Pro or Power to unlock this topic and the full AWS curriculum.
Key points
- •Flow logs record ACCEPT/REJECT decisions and traffic metadata per network interface
- •A REJECT entry points to a Security Group or NACL blocking traffic
- •No log entry at all for expected traffic points to a routing problem, not a firewall problem
- •Flow logs capture metadata only, not packet payloads — not a substitute for deep packet inspection