An engineer creates a VPC Flow Log for a subnet and wants it to record only traffic that was rejected by a security group or network ACL, then have that data queryable with Amazon Athena. Which combination of settings and destination supports this?
- Set the traffic filter to REJECT and publish the flow log to Amazon S3
- Set the traffic filter to ACCEPT and publish the flow log to Amazon CloudWatch Logs
- Flow logs can only capture ALL traffic, never REJECT-only, so a separate security tool is required
- Set the traffic filter to REJECT, but flow logs can only be queried through the EC2 console, not Athena
Why A? And why not the others?
Correct answer: A. Set the traffic filter to REJECT and publish the flow log to Amazon S3
VPC Flow Logs support ACCEPT, REJECT, or ALL as a traffic filter at creation time, and rejected-only capture is explicitly called out as useful for 'diagnosing overly restrictive security group rules.' Flow log data can be published to Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose, and AWS documents querying flow logs stored in S3 using Amazon Athena, so REJECT-filtered logs delivered to S3 satisfy both requirements. Option B is wrong on two counts: ACCEPT captures the opposite traffic than requested, and while CloudWatch Logs is a valid destination, it isn't the one AWS pairs with Athena querying. Option C is wrong because REJECT-only filtering is a first-class, documented flow log option, not something requiring extra tooling. Option D is wrong because Athena querying against flow logs delivered to S3 is a documented, supported workflow, not a console-only limitation.
Source: AWS VPC docs: Logging IP traffic using VPC Flow Logs