ExamFinch.com My Study

Study guide

14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics

Practice this exam

AWS Certified CloudOps Engineer – Associate SOA-C03

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Monitoring & Observability Infrastructure

1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms

2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation

2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda

3 Chapter 3: Performance Optimization for Compute, Storage & Databases

3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance

4 Chapter 4: Compute & Database Scalability and Elasticity

4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB

5 Chapter 5: High Availability, Fault Tolerance & Load Balancing

5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments

6 Chapter 6: Backup, Data Protection & Disaster Recovery

6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience

7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK

7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures

8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC

8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows

9 Chapter 9: Systems Manager & Event-Driven Operations Automation

9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation

10 Chapter 10: Identity, Access Management & Governance

10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs

11 Chapter 11: Data Security, Encryption & Vulnerability Management

11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings

12 Chapter 12: VPC Architecture, Endpoints & Network Protection

12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing

13 Chapter 13: DNS, Route 53 Routing & Content Delivery

13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator

14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity

14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting

14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics

Key Takeaways Explain This Topic AI

VPC Flow Logs capture IP network flow metadata without inspecting packet payloads, publishing at the VPC, subnet, or ENI level to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose.

Flow log filters specify whether to record accepted connections (ACCEPT), rejected security policy drops (REJECT), or all traffic (ALL), excluding internal AWS service traffic such as Route 53 link-local DNS and instance metadata.

Custom flow log formats extend beyond standard 5-tuple fields to capture tcp-flags, pkt-srcaddr, and pkt-dstaddr, enabling engineers to analyze TCP bitmasks (SYN flag 2, SYN-ACK flag 18, RST flag 4) and trace original IPs through NAT Gateways.

CloudWatch Logs Insights provides interactive querying to aggregate bandwidth consumption ("top talkers"), unmask malicious port scanning, and isolate asymmetric return traffic drops caused by stateless NACLs.

End-to-end network observability requires correlating VPC Flow Logs with Application Load Balancer access logs, CloudFront access logs, and AWS WAF web ACL traffic logs to diagnose application latency and security blocks.

Last updated: September 2026

14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics

CloudOps Blueprint Focus: Packet payload inspection is rarely viable in high-throughput cloud environments. The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to configure Amazon VPC Flow Logs, interpret default and custom log formats, decode TCP flags, run targeted CloudWatch Logs Insights queries, and correlate network flows with Application Load Balancer and AWS WAF telemetry.

VPC Flow Logs Architecture & Capture Scope

Amazon VPC Flow Logs captures IP traffic flow metadata entering and leaving network interfaces across an Amazon VPC. Operating out-of-band at the hypervisor level, Flow Logs impose zero latency overhead and zero compute impact on running workloads.

Capture Levels & Publishing Destinations

Flow logs can be provisioned at three architectural scopes:

VPC Level: Monitors all current and future ENIs across all subnets in the VPC.

Subnet Level: Captures traffic across all ENIs within a specific subnet.

Network Interface (ENI) Level: Surgically targets an individual ENI for focused troubleshooting.

Publish Destination Operational Characteristics Target Use Cases

Amazon CloudWatch Logs Near real-time streaming; CloudWatch metric filters and alarms; interactive querying via Logs Insights. Operational troubleshooting, security alarming, rapid incident response.

Amazon S3 Cost-effective storage; S3 Glacier lifecycle archiving; SQL analysis via Amazon Athena. Compliance data lakes, long-term auditing, forensic retention.

Amazon Kinesis Data Firehose Managed streaming delivery to external destinations; real-time Lambda transformations. Ingestion into third-party SIEMs (Splunk, Datadog) or OpenSearch.

Traffic Filters & Non-Captured Traffic

Engineers select one of three traffic filters:

ALL : Records both permitted and blocked flows; required for complete visibility.

ACCEPT : Records only traffic permitted by Security Groups and NACLs; used for capacity planning and baselining.

REJECT : Records only traffic blocked by Security Groups or NACLs; optimizes cost for threat hunting.

Important

Non-Captured Traffic: Flow Logs do not record traffic to the Amazon DNS Route 53 Resolver (VPC base CIDR + 2, e.g., 10.0.0.2 ), EC2 Instance Metadata Service ( 169.254.169.254 ), Amazon Time Sync ( 169.254.169.123 ), DHCP client traffic, or hypervisor licensing communication.

Log Formats & Extended Telemetry Fields

Flow logs aggregate packets over 10-minute intervals (or 1-minute intervals for accelerated troubleshooting).

Default vs. Custom Formats

The default format outputs 14 fields: <version> <account-id> <interface-id> <srcaddr> <dstaddr> <srcport> <dstport> <protocol> <packets> <bytes> <start> <end> <action> <log-status>

Standard protocol numbers include 6 (TCP), 17 (UDP), and 1 (ICMP).

To troubleshoot complex topologies, engineers deploy a Custom Log Format incorporating extended attributes:

tcp-flags : Bitmask identifying TCP control flags observed during the flow window.

pkt-srcaddr & pkt-dstaddr : Captures the original packet source and destination IP addresses before Network Address Translation (NAT) through a NAT Gateway.

flow-direction : Identifies whether the flow was ingress or egress relative to the interface.

traffic-path : Shows the routing path (e.g., Internet Gateway, Transit Gateway, or Peering).

Decoding TCP Flag Bitmasks

TCP flags reveal connection handshake stages:

2 (SYN): Connection initiation. Repeated tcp-flags = 2 with action = REJECT indicates blocked connection attempts or port scanning.

18 (SYN-ACK = 16 + 2): Handshake acknowledged; confirms bidirectional connectivity.

4 (RST): Connection reset; indicates abnormal session termination by a host or firewall.

1 (FIN) / 16 (ACK): Standard graceful connection teardown.

CloudWatch Logs Insights Queries for Network Troubleshooting

Amazon CloudWatch Logs Insights provides an interactive engine to scan millions of flow records rapidly.

  • 1. Identifying Port Scanning & Reconnaissance
  • To identify hostile internal or external scanning activity: filter action = "REJECT"
  • | stats count(*) as DropCount by srcaddr, dstport, protocol
  • | sort DropCount desc
  • | limit 20

A high DropCount on ports 22 (SSH), 3389 (RDP), or 445 (SMB) highlights brute-force or scanning attempts.

  • 2. Finding Top Talkers & Bandwidth Consumers
  • To isolate instances driving high cross-AZ or NAT Gateway data transfer charges: filter action = "ACCEPT"
  • | stats sum(bytes) as TotalBytes, sum(packets) as TotalPackets by srcaddr, dstaddr
  • | sort TotalBytes desc
  • | limit 10
  • 3. Diagnosing Stateless NACL Return Traffic Drops

When an application establishes outbound connections that fail to receive responses: filter (srcaddr = "10.0.1.25" and dstaddr = "198.51.100.10") or

  • (srcaddr = "198.51.100.10" and dstaddr = "10.0.1.25")
  • | fields @timestamp, srcaddr, dstaddr, srcport, dstport, protocol, action, bytes
  • | sort @timestamp desc

If the outbound request ( 10.0.1.25:52140 -> 198.51.100.10:443 ) is ACCEPT ed, but the return packet ( 198.51.100.10:443 -> 10.0.1.25:52140 ) displays REJECT , a stateless NACL is dropping the response on ephemeral port 52140 .

Correlating Multi-Layer Network Telemetry

Isolating application issues requires correlating Layer 3/4 flow logs with Layer 7 load balancer and security telemetry.

Elastic Load Balancing (ELB) Access Logs

ELB access logs provide three critical timing metrics:

request_processing_time : Latency from client request reception to dispatch to backend.

target_processing_time : Time spent by backend EC2/container instances processing the request before sending headers. High values indicate application code or database query latency.

response_processing_time : Time taken to transmit the response to the client.

Status Code Discrepancies: If elb_status_code is 504 and target_status_code is - , the backend target timed out before responding.

AWS WAF Web ACL Logs & CloudFront Logs

AWS WAF Logs: Capture the terminatingRuleId and action ( BLOCK , ALLOW , COUNT ). When users encounter HTTP 403 errors, WAF logs confirm whether managed rules (e.g., SQLi or rate-limiting) blocked the client IP.

CloudFront Access Logs: Record edge cache hits/misses, origin latency, and TLS protocol negotiation, pinpointing whether latency occurs at the edge or origin.