Question

A network engineer is troubleshooting intermittent connection failures between an application server in a private subnet and an on-premises database reached over an AWS Site-to-Site VPN. They enable VPC Flow Logs on the application server's ENI in the default format and observe log records showing ACCEPT for the outbound SYN packets to the database, but they see no corresponding records for return traffic, and the application reports connection timeouts. What is the MOST likely explanation the engineer should investigate first?

Accepted Answer

VPC Flow Logs only capture traffic that traverses the ENI; the missing return records indicate the response packets are not reaching the ENI, likely due to an asymmetric route or a firewall/NAT drop on the on-premises path.

Answer

VPC Flow Logs cannot record REJECT actions for stateful security group traffic, so the return packets are silently dropped by the security group and never logged.

Answer

The default flow log format omits the action field for inbound packets, so the return records exist but are not visible without switching to a custom format.

Answer

Flow logs aggregate bidirectional traffic into a single record, so a single ACCEPT line already represents both the outbound and return traffic for the connection.