VPC Flow Logs capture information about IP traffic going to and from network interfaces in your VPC and publish it to CloudWatch Logs, Amazon S3 or Amazon Data Firehose. They help you see which connections were attempted and accepted, but they are metadata, not a record of what was said inside the connections.
What they are for
AWS lists tasks flow logs help with:
- Diagnosing overly restrictive security group rules.
- Monitoring the traffic reaching your instance.
- Determining the direction of traffic to and from network interfaces.
For security work, those translate to questions like: did this instance talk to an address it never talked to before, and was anything trying to reach a port that should have been closed?
How they are collected
Flow log data is collected outside the path of your network traffic. AWS states it does not affect throughput or latency, and that you can create or delete flow logs without risk to network performance.
You choose a destination. Each has a different strength:
- CloudWatch Logs: Quick searches and alarms
- Amazon S3: Longer retention, and querying with Athena
- Amazon Data Firehose: Streaming into other tools
AWS documents querying flow logs from S3 with Athena, which is a common pattern for investigations.
What they cannot tell you
A flow log record describes a flow. It does not hold the contents of the traffic. So a flow log can show that a server sent a large amount of data to an unfamiliar address, but not what the data was. For that you need application logs, host logs or other sources.
AWS keeps a separate page on flow log limitations, which I did not review for this post. Read it before relying on flow logs to prove something did not happen, because absence in a flow log may not mean absence of traffic.
Cost
Publishing flow logs incurs data ingestion and archival charges for vended logs, according to AWS. To track the spend, apply cost allocation tags to the destination resource, such as the S3 bucket, and use them in your cost reports.
Practical ways to control cost: collect at the level you need, such as VPC or subnet, instead of every interface in every environment, and send long-term copies to S3 rather than keeping them in a log group.
A starting plan
- Enable flow logs on the VPCs that hold production and sensitive data.
- Send them to S3 in a log archive account, with a retention period that matches your investigation needs.
- Create a small set of saved queries: new outbound destinations, traffic to administrative ports, and rejected inbound spikes.
- Test it with a known event, such as a connection you make on purpose.
- Pair it with CloudTrail for API activity, since flow logs say nothing about who called an AWS API.
Quick check
Do flow logs slow my network?
AWS says they are collected outside the traffic path and do not affect throughput or latency.
Can flow logs show the data that was stolen?
No. They record metadata about flows. You need other logs for content and for the identity behind API calls.
Sources
Last reviewed: 19 October 2026.
