Okay.
Hello bloggers and welcome to this lecture and this lecture we're going to look at VPC flow logs so
what is a VPC flow log.
Well BPC flow logs is a feature that enables you to capture information about the IP traffic going to
and from network interfaces within your VPC and flow log data is stored using Amazon Cloud watch logs
and after you've created a flow log you can view and retrieve data in Amazon Cloud watch logs.
So it's just a way of basically going ahead and storing all the network traffic that's going on in your
VPC and flow logs can be created at three different levels you can do it at the BPC level you can do
it at an actual subnet level and then you can go all the way down to your network interface level so
down to your E and I's as well.
So let's have a look at how this works in the AWP console.
Okay.
So I mean the obvious console we need to go over to our VPC which is under network content and delivery
and then what we're going to do is we're going to go to our VPC and we're going to select our custom
BPC and we're gonna go to actions and we're going to go ahead and hit create flow log.
Now we have different filters in here.
We could just go ahead and feel uncertain what it means just click up here but this is basically the
type of traffic to be logged.
So you can choose all to log accepted and rejected traffic or you can just choose to accept to log rejected
traffic or accepted traffic only.
I'm going to go ahead and select all I want to go ahead and log everything.
Now in terms of your destination you can send it to cloud watch logs or you can send it to an S3 bucket.
I'm gonna send it to cloud watch logs in here.
It says destination log groups you have to go in an entry log destination group because we haven't done
it.
We're going to have to go over to cloud watch.
So let's go over here and we're going to always find cloud watch under management and governance and
we're going to have to create a new log group for this.
So to do that all we need to do is go over to our logs and what we're going to do is go in and say let's
get started.
We're gonna go in and create a log group and I'm gonna call this VPC VPC flow logs and that's my log
group in there now that we've done that we'd just go back to VPC which is under network content and
delivery and would go back to our species and click in here and we'll go to our actions and then we're
gonna go ahead and hit create flow log.
Again I'm just going to change back to all and then we're going to see Al VPC flow logs in that I am
role.
We haven't actually created an I am role for this yet.
So what you can do is just click here set up permissions.
That will then open up a new tab for you and you're just going to create a new I am role we're going
to call it flow logs role.
You can see the policy document in here but I'm just going to go ahead and hit allow.
And then that will take me back to my BPC section which was a little bit frustrating but if you just
open up the the old tab you should now be able to see it in here and you might just have to click in
here to refresh it but there we go flow logs rolls.
And so now I'm gonna go ahead and create my flow log and my flow log has now been created.
So that is now sending all my traffic to my cloud watch logs groups.
If I go back over to here we can go into cloud watch.
And so basically it's monitoring all IP traffic and it's going to be in here logs and you'll be able
to see it in there.
Now we'll take a while for this to propagate.
You can go ahead and force the logs to propagate by just going and visiting your Web site and refreshing
my network ASIO is still blocking my public IP address.
So that should hopefully be logged in the flow logs.
And I've just gone back to my flow logs and now I can see that it's been logged in here and can go and
look at the logs stream and this is the data in here so we can see essentially this IP address is now
trying to access our private IP and it's being rejected.
And don't worry you don't really need to know how to read this for the certified Solutions Architect
associate exam you definitely need to understand it for both advanced networking and security specialty
so we do cover it in a lot more detail in those courses.
So on to my exam tips just remember the following You cannot enable flow logs for BP sees that appeared
with your VPC unless the peer VPC is within your own AWB account you cannot tag a flow log at this time
and then after you've created a flow log you cannot change its configuration for example you can't associate
a different I am roll with the flow log.
Also remember that not all IP traffic is monitored traffic generated by instances when they contact
the Amazon DNS server that's not going to be monitored if you use your own DNS server then all traffic
to that DNS server will be logged traffic generated by Windows instances for Amazon windows licensing
activation is not going to be monitored and then traffic to and from 1 6 9 2 5 4 0 1 6 9 2 5 4 for instance
metadata to you remember we did that in the E2 section of the.
And then DHS IP traffic is not monitored as well as well as traffic to the reserved IP addresses for
the default VPC router.
So that is it for VPC flow logs.
Very very straightforward.
In the next lecture we are going to compare Nats versus bastions.
And then we're going to go on to VPC and points and then we finish the VPC section of course.
So if you got the time please join me in the next lecture.
Thank you.