AWS Cloud Architecture•Part 2: Networking, VPC & Traffic Routing (6 - 20)
VPC Flow Logs analysis.
In Simple Words: Captures IP traffic going to and from network interfaces in your VPC. Streamed to CloudWatch Logs or S3 and queried with Athena to identify port scanning, rejected traffic (REJECT), and routing misconfigurations.
sql
-- Athena SQL query on VPC Flow Logs to find rejected inbound traffic:
SELECT srcaddr, dstport, count(*) AS reject_count
FROM vpc_flow_logs
WHERE action = 'REJECT'
GROUP BY srcaddr, dstport
ORDER BY reject_count DESC
LIMIT 10;