Lion Cipher Lab
Turn on VPC Flow Logs and hunt in them: rejected traffic, scanning, and unexpected egress
- Cloud Security
- Intermediate
- ~55 min
- Free · no account required
Why it matters
When something goes wrong in a cloud account, the first two questions are almost always "who called which API?" and "which machine talked to which machine?". CloudTrail answers the first. Nothing answers the second unless you turned on VPC Flow Logs — and the default in a fresh AWS account is OFF. That means most beginners' accounts have a total blind spot at the network layer: an instance could be scanned all day, or quietly sending gigabytes to an address nobody recognises, and there would be no record of it at all. Turning flow logs on, and knowing how to query them, is one of the…
What you'll learn
- VPC Flow Logs
- cloud network telemetry
- reading a flow log record field by field
- CloudWatch Logs Insights queries
- spotting scanning and unexpected egress
- IAM roles for log delivery
- log-cost awareness and cleanup
Steps in this lab
- The mental model: two logs, two completely different questions
- Find the VPC, instance and interface you are about to watch — all of them yours
- Create the IAM role that lets the flow log write to CloudWatch Logs
- Turn the flow log on at the VPC level, delivering to CloudWatch Logs
- Read a flow log record out loud, field by field
- Generate traffic worth finding — against your own instance, on purpose
- Hunt: five CloudWatch Logs Insights queries that find the story
- The judgment layer: what flow logs cannot tell you, and what to reach for instead
- CloudWatch Logs versus S3 — the cost call — then clean up so nothing keeps billing