Question

A network operations team publishes VPC Flow Logs to a CloudWatch Logs log group. Security wants to be automatically alerted whenever the number of REJECTED inbound connection attempts to a set of database subnets exceeds 100 within a 5-minute window, so the on-call engineer can investigate potential scanning activity. The solution must be fully native to CloudWatch and require no additional compute. What should the team implement?

Accepted Answer

Create a CloudWatch Logs metric filter that matches log events where the action field equals REJECT, then create a CloudWatch alarm on the resulting metric with a threshold of 100 over a 5-minute period and an SNS notification action.

Answer

Configure a Lambda subscription filter on the log group that parses each event and increments a custom metric, then alarm on that metric.

Answer

Enable Contributor Insights on the flow log group to rank rejected source IPs, and rely on the Contributor Insights dashboard for alerting.

Answer

Export the flow logs to S3 and run a scheduled Athena query with EventBridge to count rejects, publishing an SNS notification when the count exceeds 100.