The Invisible Network

Your SOC has flagged an alert: an EC2 instance appears to be communicating with an unknown external IP. You need to answer basic questions:

• Where is the traffic going?
• How much data was transferred?
• When did it start, and what ports are being used?

You open FlowLogs and search for logs. There are none. No network telemetry exists for this VPC. Every connection that has ever been made, legitimate or malicious, left zero trace at the network layer.

This is not an edge case. Many teams deploy workloads into VPCs without enabling FlowLogs, either because they forget, assume another tool covers it, or want to avoid the cost. The result is a critical visibility gap that makes investigation impossible and detection a guessing game. This is how the Marriott breach persisted for four years.

Learning Objectives

• Understand what VPC FlowLogs capture and their limitations
• Identify when FlowLogs are missing from a VPC
• Enable FlowLogs with an appropriate IAM role and log destination
• Query Flow Log data using CloudWatch Logs Insights
• Build reusable security queries for monitoring and investigation
• Design a network visibility baseline for new VPC deployments

Prerequisites

• Being able to set up your environment (First Steps Into AWS room)
• Basic Linux commands (Linux Fundamentals room)
• Have a basic understanding of the AWS networking service (Introduction to Cloud Networking room)