Network and service logs
Lesson 3 of 4 in The Logging Architecture.
The exam does not ask “what does a VPC flow log contain?”. It describes a threat and asks which log would have shown it. So build the index in that direction: threat → the log you must have enabled, because by the time you want the answer it is far too late to turn the log on.
That framing also forces the honest admission every network-logging question turns on: each log has a blind spot, and the blind spots are the whole game. Flow logs cannot see DNS names. Resolver query logs cannot see bytes transferred. CloudTrail cannot see a packet. Nothing short of a packet capture sees payload — and packet-level analysis is explicitly out of scope for this exam, which tells you AWS wants you reasoning about metadata coverage instead.
| The threat | The log you need | Why that one | What it still cannot tell you |
|---|---|---|---|
An instance is talking to an unexpected external address | addresses, ports, protocol, bytes, and ACCEPT or REJECT per flow | the hostname asked for, or what was in the packets | |
Data is leaving over DNS — long random subdomain labels | flow logs deliberately omit traffic to the Amazon-provided DNS resolver, so this is the only record of the query | how many bytes moved, or whether the connection succeeded | |
Segmentation between environments is leaking | per-VPC logs see their own interfaces; only the hub sees which VPC talked to which, and across which attachment | application-layer detail, or anything inside a VPC | |
Someone is probing the application with SQL injection payloads | AWS WAF logs | full inspected request detail with the matched rule and the action taken (allow, block, count, CAPTCHA) | anything that never reached the WAF-protected distribution or load balancer |
Which client IPs hit the application, and with what response codes | ELB access logs, or CloudFront standard logs | per-request records including client address, target, latency, status and the TLS cipher negotiated | who the authenticated principal was, in AWS identity terms |
Which principal read a specific S3 object, and when | CloudTrail data events for that bucket | full IAM identity context, near real time, routable to EventBridge | nothing — but it is off by default and billed per event |
Cheap bulk history of requests to a bucket | best-effort request records at no per-request charge | prompt delivery, guaranteed completeness, or rich identity detail |
Three facts about flow logs carry real exam weight.
They are metadata, not content. A record is one network flow within an aggregation interval: source and destination address and port, protocol, packet and byte counts, start and end time, and the action — ACCEPT or REJECT — which is how you tell whether security groups and network ACLs allowed the flow. No payload, ever.
Their exclusions are specific and testable. Flow logs do not capture traffic to the Amazon-provided DNS server (though traffic to your own DNS server is logged), instance metadata at 169.254.169.254, the Amazon Time Sync Service, DHCP, traffic to the default VPC router’s reserved address, Windows license activation, or traffic between a VPC endpoint network interface and a Network Load Balancer interface. The DNS exclusion is the one that matters most: it is precisely why DNS-based exfiltration needs Resolver query logs.
The record format is immutable. Once a flow log exists you cannot add fields, change the format or re-point the destination — you delete it and create a new one. So choosing a custom format up front is a security decision: pkt-srcaddr and pkt-dstaddr preserve the original addresses behind a NAT or load balancer, tcp-flags distinguishes a completed handshake from a SYN sweep, and flow-direction and traffic-path tell you which way traffic went and how it left. Decide before the incident, because afterwards you cannot backfill. Destinations are CloudWatch Logs, S3 or Firehose, and the configured aggregation interval is one or ten minutes — so flow logs are a near-real-time analysis tool, never a packet-accurate one.
Interactive sorting exercise: An investigator asks one question. Which log answers it?
The service logs round out the picture, and each has one characteristic worth remembering.
ELB access logs are per-request records delivered to S3, and they are off by default — enable them per load balancer. Alongside client address, target, latency and status they record the negotiated TLS protocol and cipher, which is the evidence base for Domain 5’s in-transit controls. They are also your only view of requests the load balancer served; a connection the load balancer refused leaves a flow-log REJECT and nothing else.
CloudFront offers two tiers, and the choice is latency against completeness. Standard logs are delivered to S3 (or now to CloudWatch Logs and Firehose) on a delay and are the cheap, complete archive. Real-time logs stream a configurable sampling rate and field set to Kinesis Data Streams within seconds — the option when a requirement says “detect and react within seconds at the edge”. If a question mentions sampling, it is pointing at real-time logs.
AWS WAF logs record each inspected request with the terminating rule and action, delivered to CloudWatch Logs, S3 or Firehose, with redaction available for sensitive headers. They are the only log in this lesson that sees request content, which also makes them the one most likely to capture something you did not intend to store.
S3 server access logs versus CloudTrail data events is the comparison the exam makes most often. Data events: near real time, full IAM identity, EventBridge-routable, charged per event. Server access logs: best-effort delivery within hours, no per-request charge, less identity detail. Choose data events when you need prompt, attributable, automatable evidence; server access logs when you want inexpensive bulk history. And never configure a bucket to log to itself — that is a delivery loop, and a configuration mistake worth recognising in an answer option.
Key terms: VPC Flow Logs, Transit gateway flow logs, Route 53 Resolver query logs, S3 server access logging
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.