Create a flow log that publishes to CloudWatch Logs - Amazon Virtual Private Cloud
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Create a flow log that publishes to CloudWatch Logs

You can create flow logs for your VPCs, subnets, or network interfaces. If you perform these steps as a user using a particular IAM role, ensure that the role has permissions to use the iam:PassRole action.

Prerequisite

Verify that the IAM principal that you are using to make the request has permissions to call the iam:PassRole action.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:PassRole"],
      "Resource": "arn:aws-cn:iam::account-id:role/flow-log-role-name"
    }
  ]
}
To create a flow log using the console

  1. Do one of the following:

  2. Choose Actions, Create flow log.

  3. For Filter, specify the type of traffic to log. Choose All to log accepted and rejected traffic, Reject to log only rejected traffic, or Accept to log only accepted traffic.

  4. For Maximum aggregation interval, choose the maximum period of time during which a flow is captured and aggregated into one flow log record.

  5. For Destination, choose Send to CloudWatch Logs.

  6. For Destination log group, choose the name of an existing log group or enter the name of a new log group that will be created when you create this flow log.

  7. For IAM role, specify the name of the role that has permissions to publish logs to CloudWatch Logs.

  8. For Log record format, select the format for the flow log record.

    • To use the default format, choose Amazon default format.

    • To use a custom format, choose Custom format and then select fields from Log format.

  9. For Additional metadata, select if you want to include metadata from Amazon ECS in the log format.

  10. (Optional) Choose Add new tag to apply tags to the flow log.

  11. Choose Create flow log.

To create a flow log using the command line

Use one of the following commands.

The following Amazon CLI example creates a flow log that captures all accepted traffic for the specified subnet. The flow logs are delivered to the specified log group. The --deliver-logs-permission-arn parameter specifies the IAM role required to publish to CloudWatch Logs.

aws ec2 create-flow-logs --resource-type Subnet --resource-ids subnet-1a2b3c4d --traffic-type ACCEPT --log-group-name my-flow-logs --deliver-logs-permission-arn arn:aws-cn:iam::123456789101:role/publishFlowLogs