FlowLog

Source: src/AWS/EC2/FlowLog.ts

A flow log captures information about the IP traffic going to and from a VPC, subnet, or network interface, and publishes it to CloudWatch Logs, S3, or a Kinesis Data Firehose delivery stream. Use it for network monitoring, traffic analysis, and troubleshooting security-group / NACL rules.

A flow log is immutable: every property except tags is fixed at creation, so changing the monitored resource, destination, or traffic type replaces the flow log. For CloudWatch Logs delivery you must supply a logGroupName and a deliverLogsPermissionArn — an IAM role that EC2’s vpc-flow-logs service principal can assume to write to the group.

Creating a Flow Log

VPC Flow Log to CloudWatch Logs

const logGroup = yield* AWS.Logs.LogGroup("FlowLogs", {});

const role = yield* AWS.IAM.Role("FlowLogRole", {
  assumeRolePolicyDocument: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "vpc-flow-logs.amazonaws.com" },
      Action: "sts:AssumeRole",
    }],
  },
  inlinePolicies: {
    deliver: {
      Version: "2012-10-17",
      Statement: [{
        Effect: "Allow",
        Action: [
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:DescribeLogStreams",
        ],
        Resource: "*",
      }],
    },
  },
});

const flowLog = yield* AWS.EC2.FlowLog("VpcFlowLog", {
  resourceType: "VPC",
  resourceId: myVpc.vpcId,
  logGroupName: logGroup.logGroupName,
  deliverLogsPermissionArn: role.roleArn,
});

Captures all traffic for the VPC and delivers it to the CloudWatch Logs group via the delivery role.

S3 Flow Log for Rejected Traffic

const flowLog = yield* AWS.EC2.FlowLog("RejectedTraffic", {
  resourceType: "Subnet",
  resourceId: mySubnet.subnetId,
  trafficType: "REJECT",
  logDestinationType: "s3",
  logDestination: bucket.bucketArn,
});

Delivers only rejected-traffic records for a subnet directly to an S3 bucket (no IAM role required for S3 delivery).