Question

A network operations team stores VPC Flow Logs in a CloudWatch Logs log group. During an unexpected NAT gateway data-processing cost spike, an engineer must quickly identify which private instances (source IP addresses) generated the most outbound bytes over the last 3 hours, without deploying additional infrastructure. What is the FASTEST approach to produce this ranked list?

Accepted Answer

Run a CloudWatch Logs Insights query against the flow log group that parses the bytes field, filters on the NAT gateway ENI, groups by source address with sum(bytes), and sorts descending

Answer

Export the log group to Amazon S3, create an AWS Glue crawler and an Athena table, then run a GROUP BY query on source address

Answer

Enable Traffic Mirroring on the NAT gateway ENI and analyze captured packets with a third-party tool to rank source hosts by volume

Answer

Create a CloudWatch metric filter that increments a custom metric per source IP and view the metric in a CloudWatch dashboard