steampipe plugin install awssteampipe plugin install aws

Table: aws_vpc_flow_log_event

VPC flow logs capture information about the IP traffic going to and from network interfaces in your VPC.

This table reads flow log records from CloudWatch log groups.

Important notes:

You must specify log_group_name in a where clause in order to use this table.
For improved performance, it is advised that you use the optional qual timestamp to limit the result set to a specific time period.
This table supports optional quals. Queries with optional quals are optimised to used CloudWatch filters. Optional quals are supported for the following columns:
- action
- dst_addr
- dst_port
- event_id
- filter
- interface_id
- log_status
- log_stream_name
- region
- src_addr
- src_port
- timestamp

Examples

List events that occurred over the last five minutes

select
  log_group_name,
  log_stream_name,
  log_status,
  action,
  ingestion_time,
  timestamp,
  interface_id,
  interface_account_id,
  src_addr,
  region
from
  aws_vpc_flow_log_event
where
  log_group_name = 'vpc-log-group-name'
  and timestamp >= now() - interval '5 minutes';

List ordered events that occurred between five to ten minutes ago

select
  log_group_name,
  log_stream_name,
  log_status,
  action,
  ingestion_time,
  timestamp,
  interface_id,
  interface_account_id,
  src_addr,
  region
from
  aws_vpc_flow_log_event
where
  log_group_name = 'vpc-log-group-name'
  and timestamp between (now() - interval '10 minutes')
  and (now() - interval '5 minutes')
order by
  timestamp asc;

List distinct interface IDs found in all flow logs that occurred over the last hour

select
  distinct(interface_id)
from
  aws_vpc_flow_log_event
where
  log_group_name = 'vpc-log-group-name'
  and timestamp >= now() - interval '1 hour';

Get details for all rejected traffic that occurred over the last hour

select
  log_stream_name,
  timestamp,
  interface_id,
  interface_account_id,
  src_addr,
  src_port,
  dst_addr,
  dst_port
from
  aws_vpc_flow_log_event
where
  log_group_name = 'vpc-log-group-name'
  and action = 'REJECT'
  and timestamp >= now() - interval '1 hour';

Filter examples

For more information on CloudWatch log filters, please refer to Filter Pattern Syntax.

List flow logs with traffic between specific IP addresses that occurred over the last hour

select
  log_group_name,
  log_stream_name,
  log_status,
  action,
  ingestion_time,
  timestamp,
  interface_id,
  interface_account_id,
  src_addr,
  region
from
  aws_vpc_flow_log_event
where
  log_group_name = 'vpc-log-group-name'
  and log_stream_name = 'eni-1d47d21d-all'
  and (
    src_addr = '10.85.14.210'
    or dst_addr = '10.85.14.213'
  )
  and timestamp >= now() - interval '1 hour'
order by
  timestamp;

List flow logs with source IP address in a specific range that occurred over the last hour

select
  log_group_name,
  log_stream_name,
  log_status,
  action,
  ingestion_time,
  timestamp,
  interface_id,
  interface_account_id,
  src_addr,
  region
from
  aws_vpc_flow_log_event
where
  log_group_name = 'vpc-log-group-name'
  and log_stream_name = 'eni-1d47d21d-all'
  and src_addr << '10.0.0.0/8' :: inet
  and timestamp >= now() - interval '1 hour'
order by
  timestamp;

.inspect aws_vpc_flow_log_event

AWS VPC Flow Log events from CloudWatch Logs

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
action	text	The action that is associated with the traffic: ACCEPT — The recorded traffic was permitted by the security groups and network ACLs. REJECT — The recorded traffic was not permitted by the security groups or network ACLs.
bytes	bigint	The number of bytes transferred during the flow.
dst_addr	inet	The destination address for outgoing traffic, or the IPv4 or IPv6 address of the network interface for incoming traffic on the network interface. The IPv4 address of the network interface is always its private IPv4 address. See also pkt-dstaddr.
dst_port	bigint	The destination port of the traffic.
end	timestamp with time zone	The time when the last packet of the flow was received within the aggregation interval. This might be up to 60 seconds after the packet was transmitted or received on the network interface.
event_id	text	The ID of the event.
filter	text	Filter pattern for the search.
ingestion_time	timestamp with time zone	The time when the event was ingested.
interface_account_id	text	The AWS account ID of the owner of the source network interface for which traffic is recorded. If the network interface is created by an AWS service, for example when creating a VPC endpoint or Network Load Balancer, the record may display unknown for this field.
interface_id	text	The ID of the network interface for which the traffic is recorded.
log_group_name	text	The name of the log group to which this event belongs.
log_status	text	The logging status of the flow log: OK — Data is logging normally to the chosen destinations. NODATA — There was no network traffic to or from the network interface during the aggregation interval. SKIPDATA — Some flow log records were skipped during the aggregation interval. This may be because of an internal capacity constraint, or an internal error.
log_stream_name	text	The name of the log stream to which this event belongs.
packets	bigint	The number of packets transferred during the flow.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
protocol	bigint	The IANA protocol number of the traffic. For more information, see Assigned Internet Protocol Numbers.
region	text	The AWS Region in which the resource is located.
src_addr	inet	The source address for incoming traffic, or the IPv4 or IPv6 address of the network interface for outgoing traffic on the network interface. The IPv4 address of the network interface is always its private IPv4 address. See also pkt-srcaddr.
src_port	bigint	The source port of the traffic.
start	timestamp with time zone	The time when the first packet of the flow was received within the aggregation interval. This might be up to 60 seconds after the packet was transmitted or received on the network interface.
timestamp	timestamp with time zone	The time when the event occurred.
version	bigint	The VPC Flow Logs version. If you use the default format, the version is 2. If you use a custom format, the version is the highest version among the specified fields. For example, if you specify only fields from version 2, the version is 2. If you specify a mixture of fields from versions 2, 3, and 4, the version is 4.

turbot/aws