A connection between EC2 instances fails.
Determine whether a security group or Network ACL rejected the traffic.
Which feature is most appropriate?
Enable VPC Flow Logs for the relevant VPC, subnet, or network interface.
Detailed explanation
S3 versioning does not collect VPC network-flow records.
S3 versioning does not collect VPC network-flow records.
Flow Logs record network-flow metadata, including whether traffic was accepted or rejected.
Flow Logs record network-flow metadata, including whether traffic was accepted or rejected.
DNS health checks do not provide detailed VPC flow records.
DNS health checks do not provide detailed VPC flow records.
Console sign-in auditing does not show packet-flow decisions.
Console sign-in auditing does not show packet-flow decisions.
Check official documentation
Compare the following points with the official documentation.
VPC Flow Logs traffic recordsの公式説明を確認する。
What to confirm
VPCフローログとCloudTrail API監査の違いを説明できる。
Key points
- VPC Flow Logs
- ACCEPT/REJECT
- ENI
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Flow versus API audit
Flow Logs describe network traffic; CloudTrail describes API calls.
Metadata scope
Flow Logs do not capture packet payloads, but they help identify control decisions.