Instructor: So now let's talk about VPC flow logs.
VPC flow logs allow you to capture information
from IP traffic going into your interfaces.
So that could be at the VPC level, the subnet level,
or the Elastic Network Interface, ENI, level.
So we have three kinds of flow logs.
They're very helpful to monitor and troubleshoot
connectivity issues happening within your VPC.
So these flow logs can be sent to two destinations.
They can be sent to Amazon history and CloudWatch logs,
and they will capture information
for also AWS managed interfaces,
such as ELB, RDS, ElastiCache,
Redshift, WorkSpaces, your NATGateway,
your Transit gateway, and so on.
So in this graph was very simple.
Your flow logs are at the VPC level, for example,
or subnets or ENI level
and they are sent to CloudWatch and Amazon history.
So this is what a VPC flow log looks like.
So there is a format associated with it,
but there is a version, account ID, interface ID,
source address, destination address,
source port, destination port, protocol,
packets, bytes start, and action, and log status.
So this is metadata about the network packets
going into your VPC,
and you don't need to remember this at a high level, right?
But let's have a look at what information we can get
out of these flow logs.
So the source address and the destination address
help identify problematic IP.
This is where you see if an IP is repeatedly being denied.
Maybe there is something wrong with that IP,
or maybe you're being attacked by a specific IP.
Source port and destination port
helps you identify the preventative ports.
Action is going to be either accept or reject,
and so it's going to say whether or not
it's a success or failure at the SG or NACL level.
And we'll see this in the very next slide.
And so this can be used, the VPC flow logs,
to do analytics on usage patterns
or detect and manage the behavior, port scans, and so on.
Now to query these flow logs, you have two ways of doing it.
The best way is to do Athena on S3.
Or if you wanted to do a streaming analysis,
you could use CloudWatch Logs Insights.
So here are some examples that you can have a look
on your own time for flow logs.
So how do we use flow logs
to troubleshoot security group and NACL issues?
Well we look at the action field.
So let's have a look at the typical incoming request
for your NACL on your subnet.
So remember your NACLs are stateless
and your security groups are stateful.
So what happens?
Well, if we get an inbound reject,
so we see that the inbound request
coming from the outside to our EC2 instance is rejected,
that can mean that either, from this graph,
the NACL is refusing the request
or the security group is refusing the request.
And this makes sense, right?
But if we have a inbound accept and an outbound reject,
it can only mean a NACL issue.
Why, well because your security group is stateful
and if the inbound is allowed because of the accept,
automatically, the outbound will be allowed
thanks to the statefullness of your security group.
So for outgoing requests, similar analysis, right?
This is the diagram we know already.
And so if you got an outbound reject,
then you have a NACL or a security group issue,
but if you got a outbound accept and an inbound reject,
then it must mean a NACL issue.
So that's it, flow logs are very helpful
and they can come up just at a high level at the exam
and in this kind of troubleshooting scenario.
So I hope you liked it
and I will see you in the next lecture.