Note_Tech

All technological notes.

Project maintained by simonangel-fong Hosted on GitHub Pages — Theme by mattgraham

AWS Networking - Flow Logs

flow_log_diagram

Capture information about IP traffic going into your interfaces:
- VPC Flow Logs
- Subnet Flow Logs
- Elastic Network Interface (ENI) Flow Logs
Helps to monitor & troubleshoot connectivity issues
Flow logs data can go to S3, CloudWatch Logs, and Kinesis Data Firehose
Captures network information from AWS managed interfaces too:
- ELB, RDS, ElastiCache, Redshift, WorkSpaces, NATGW, Transit Gateway…
Sample:
- How can you capture information about IP traffic inside your VPCs?
  - Enable VPC Flow Logs
  - Traffic Mirroring is copying.

flow_log_syntax

srcaddr & dstaddr – help identify problematic IP
srcport & dstport – help identity problematic ports
Action – success or failure of the request due to Security Group / NACL
Can be used for analytics on usage patterns, or malicious behavior
Query VPC flow logs using Athena on S3 or CloudWatch Logs Insights
Flow Logs examples: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs- records-examples.html

Look at the ACTION field
Incoming Requests
- Inbound REJECT => NACL or SG
- Inbound ACCEPT, Outbound REJECT => NACL (stateless, sg=stateful)

flow_log_incoming_requests

Outgoing Requests
- Outbound REJECT => NACL or SG
- Outbound ACCEPT, Inbound REJECT => NACL(stateless, sg=stateful)

flow_log_outgoing_requests

flow_log_architecture_cloudWatch_contributor

flow_log_architecture_cloudWatch_sns

flow_log_architecture_s3_athena

hands-on

hands-on

hands-on

Create Athena table for flow log
- ref: https://docs.aws.amazon.com/athena/latest/ug/vpc-flow-logs.html
- Modify location
Location of URI in the S3 where flow log is stored.

hands-on