NetworkFlowMonitoring NetFlow sFlow VPCFlowLogs
Network-level traffic telemetry — NetFlow/sFlow are the vendor router/switch protocols; AWS's equivalent is VPC Flow Logs, which record IP traffic metadata (source/dest, ports, bytes, accept/reject) for network interfaces in your VPC. Distinct from the application-level logs/metrics/traces elsewhere in this folder.
Why we need this / what value this brings
Application logs and metrics tell you what your app did; flow logs tell you what actually happened on the network — the only source of truth when the question is 'did this traffic even leave/reach the instance' rather than 'what did the app log about it'.
When to use this
Enable by default at the VPC level for security/audit purposes; dig into the actual log data when debugging connectivity issues (like the private-subnet-to-OpenRouter scenario) or investigating suspicious traffic.
How to use or implement this
Turn on VPC Flow Logs at the VPC (or subnet/ENI) level, ship them to CloudWatch Logs or S3, and query for REJECT entries first when debugging a connectivity issue — that tells you immediately whether a security group/NACL is the blocker.
Research questions
- Are VPC Flow Logs enabled on Localz's VPC — would you actually be able to confirm the NAT Gateway egress path (see Networking/VPC-Subnetting/NAT-Gateway-Egress) is being used, or investigate a security incident, without them?
- NetFlow/sFlow themselves are router/switch-level protocols you'd never configure directly on managed cloud infra — mainly relevant as AWS SAA-C03 background and for recognizing the term if it comes up integrating with on-prem/hybrid infra.
Empty folder — drop notes, links, and findings here as you research.