Within your AWS account, it's likely that you have a number of different subnets, both private and public, allowing external connectivity. You may even have multiple VPCs connected via VPC peering connections or via AWS Transit Gateway. Either way, you will have a lot of network traffic traversing your AWS infrastructure from multiple different sources, both internally and externally, across thousands of interfaces. Using flow logs gives you the ability to capture this IP traffic across the network interfaces that are attached to your resources, which could number in the tens of thousands in a corporate environment!
For a recap of subnets and VPC infrastructure, please review the details found in Chapter 7, Configuring Infrastructure Security.
Flow logs can be configured for the following resources:
- Your VPC
- A subnet within your VPC
- A network interface from your EC2 instances, or interfaces created by Elastic Load Balancing, Amazon RDS...
