Flow logs do not capture all traffic flowing across the internet. If you need to monitor all IP traffic, including the payload, you can use AWS Fargate for traffic mirroring.
When monitoring devices or for out-of-band security, traffic mirroring is a technique for copying a specified ethernet interface’s incoming and outgoing traffic to a second interface for further analysis:
For analyzing traffic in AWS, the default option is to enable AWS VPC Flow Logs either by Amazon Virtual Private Cloud (VPC), subnetwork, or elastic network interface.
The flow logs capture the IP traffic flow, usually characterized by a Five-Tuple (or 5-tuple) set of values:
The main caveat of flow logs is that they do not capture all IP traffic. They do not log the following types:
Furthermore, flow logs only capture the traffic initiation itself. After establishing the session, the payload is not logged at all.
If you need to monitor all IP traffic, including the payload, consider using AWS’s VPC traffic mirroring.