Question

A network operations team wants to automatically respond to security-relevant traffic patterns detected in VPC Flow Logs. Flow logs are delivered to a CloudWatch Logs log group. When a source IP generates more than 100 REJECT records against a specific set of hosts within a 5-minute window, the team wants an automated workflow to add the offending IP to a network ACL deny entry without any manual intervention. Which approach implements this with the least operational overhead?

Accepted Answer

Create a CloudWatch Logs metric filter on the log group that matches REJECT records, set a CloudWatch alarm at a threshold of 100, and configure the alarm to invoke a Lambda function via an SNS topic that parses recent logs and updates the network ACL.

Answer

Export the flow logs to S3 on a 5-minute schedule and run a nightly Athena query to identify offending IPs, then manually update the network ACL.

Answer

Enable Traffic Mirroring on the affected ENIs and send the mirrored packets to an appliance that programmatically updates the network ACL.

Answer

Increase the flow log maximum aggregation interval to 10 minutes so the REJECT records are batched, then use a CloudWatch Contributor Insights rule to block the IP automatically.