Question

A company runs 40 VPCs attached to a Transit Gateway with a centralized egress VPC that hosts NAT gateways for all outbound internet traffic. The finance team reports that data processing and NAT gateway charges have grown significantly. The networking team suspects a small number of workloads are responsible for the bulk of internet-bound traffic. They need to identify the specific instances and destinations driving cost with minimal ongoing operational overhead and the ability to run ad-hoc SQL-style analysis over months of historical data. Which approach best meets these requirements?

Accepted Answer

Enable VPC Flow Logs delivered to Amazon S3 in Parquet format with Hive-compatible partitioning, and use Amazon Athena to query traffic volume by source address and destination over time.

Answer

Enable VPC Flow Logs on the egress VPC ENIs publishing to CloudWatch Logs, then create metric filters and CloudWatch dashboards to track byte counts per source IP.

Answer

Enable Transit Gateway Flow Logs to CloudWatch Logs and use CloudWatch Logs Insights to aggregate bytes per attachment, then correlate attachments to VPCs manually.

Answer

Use VPC Reachability Analyzer against the egress VPC to trace the paths of high-volume workloads and identify the instances generating the most NAT traffic.