VPC Flow Logs is a monitoring solution to troubleshoot, analyze, monitor, and get insights into the IP traffic. VPC Flow Logs can be published to Amazon S3, CloudWatch logs, or Amazon Kinesis Data Firehose.
In this Cloud Lab, you will first create a VPC with public and private subnets, an internet gateway, and a NAT gateway. You’ll then create an S3 bucket and VPC Flow Logs and publish them into the bucket. You’ll also launch EC2 instances and deploy a React application. To simulate a scenario of restricted communication, you deliberately configure a restrictive security group. Consequently, the React application will be unable to communicate with the back-end server.
After that, you will use Amazon Athena to query the logs from the bucket and diagnose the restrictive security group issue. Then, you’ll learn to publish VPC Flow Logs to the CloudWatch Logs and configure the SNS topic and CloudWatch alarm to send email notifications for malicious traffic.
After completing this Cloud Lab, you can monitor your application’s traffic and automate notifications based on VPC Flow Logs. The following is the high-level architecture diagram of the infrastructure that you will create in this Cloud Lab:
