VPC Flow Logs Search

Overview

VPC Flow Logs Search lets you view network traffic for a specific resource from the past 24 hours.

How It Works

The search interface has three steps:

1. Select AWS Account: Choose which account to search
2. Select Resource: Pick a specific resource (EC2, RDS, ElastiCache, Load Balancer, etc.)
3. Click "Search Traffic": Load the traffic data

What You See

After searching, you'll see traffic data organized into 4 tabs:

Inbound Traffic

Traffic coming into the selected resource:

• Shows accepted connections only
• Source resource or IP address
• Destination port
• Protocol (TCP, UDP, ICMP)
• Total data transferred
• Packet count

Outbound Traffic

Traffic going out from the selected resource:

• Shows accepted connections only
• Destination resource or IP address
• Destination port
• Protocol
• Total data transferred
• Packet count

Blocked Inbound

Connection attempts to the selected resource that were rejected:

• Blocked by security groups or Network ACLs
• Shows which sources tried to connect
• Port they tried to access
• Number of blocked attempts

Blocked Outbound

Connection attempts from the selected resource that were rejected:

• Blocked by security groups or Network ACLs
• Shows which destinations the resource tried to reach
• Port it tried to access
• Number of blocked attempts

Traffic Table Columns

Each traffic flow shows:

• Source: Resource name or IP address
• Destination: Resource name or IP address
• Protocol: TCP, UDP, or ICMP
• Port: Destination port number
• Data: Total bytes transferred (formatted as KB, MB, GB)
• Packets: Number of packets in the flow
• Blocked Count: (Blocked tabs only) Number of rejected connection attempts

Data Time Range

The search shows traffic from the past 24 hours based on when flow logs were last loaded.

Use Cases

Security Investigation:

• Check blocked inbound traffic for potential attacks
• Verify security groups are working correctly
• Identify unexpected connection attempts

Troubleshooting:

• Find why a resource can't connect to another
• Check if traffic is being rejected
• Verify expected traffic is flowing

Traffic Analysis:

• See top sources/destinations for a resource
• Identify high-bandwidth connections
• Understand communication patterns

Navigating from Infrastructure Diagram

When you click on a resource with blocked connections in the Infrastructure Diagram, it will:

• Automatically select that resource
• Load the traffic search page
• Default to the "Blocked Inbound" tab

Limitations

• Shows top 50 traffic flows per category
• Data is from the last flow logs load (updated every 6 hours)
• Only shows resources that have been discovered in your account
• Requires VPC Flow Logs to be enabled and loaded

Next Steps