Q: You enable VPC Flow Logs on a production VPC, dumping 100GB per day of accept/reject traffic to S3. A developer is having connectivity issues, but analyzing raw logs is impossible. What queries do you run to isolate the problematic traffic pattern?

VPC Flow Logs capture every packet at the ENI (Elastic Network Interface) level. Each log entry includes source IP, destination IP, port, action (ACCEPT/REJECT), and protocol.

• More REJECT than ACCEPT on a port: NACL or Security Group rules are asymmetric (outbound allowed but inbound blocked).
• ACCEPT logged but application still fails: Application isn't listening, or OS firewall is blocking (check target security group egress rules).
• No logs at all for a destination: Traffic never reached the VPC (routing issue upstream).

Quick queries (using Athena/S3 SQL): Find all rejected traffic to a specific destination: This reveals: Is traffic being dropped at the NACL or Security Group level? From which source IPs? Check if the destination itself is rejecting or the network layer is: Root cause scenarios:

SELECT srcaddr, dstaddr, dstport, protocol, COUNT(*) as attempts
FROM vpc_flow_logs
WHERE dstaddr = '10.0.2.50'  -- The destination with issues
  AND action = 'REJECT'
  AND day >= '2025-01-15'
GROUP BY srcaddr, dstaddr, dstport, protocol
ORDER BY attempts DESC