Glossary
VPC Flow Logs
AWS network flow records per network interface: addresses, ports, protocol, bytes, packets and accept/reject — metadata only, with no payload.
VPC Flow Logs record IP traffic metadata for network interfaces in a VPC,
subnet or single interface: source and destination addresses and ports,
protocol, packets, bytes, a start/end window and whether security groups
or network ACLs accepted or rejected the traffic. The default format is
version 2; custom formats add fields such as instance-id, pkt-srcaddr
or flow-direction.
Records are aggregated over up to ten minutes (one minute or less on Nitro instances) and delivered to S3, CloudWatch Logs or Firehose. Some traffic is never logged, including queries to the Amazon DNS server and instance metadata requests.
In investigations they show exfiltration volume and crypto-mining connections: see VPC Flow Logs analysis. Reference: Flow log records.