Question

A security engineer needs to capture VPC Flow Logs for a production VPC. The requirements are: near-real-time alerting when specific traffic patterns (e.g., traffic to a known-malicious IP range) appear, and the ability to trigger an automated Lambda response within seconds. The team also wants to minimize the operational effort of building the alerting pipeline. Which flow log destination and configuration best meets these requirements?

Accepted Answer

Send VPC Flow Logs to CloudWatch Logs, create a metric filter matching the malicious IP pattern, and configure a CloudWatch alarm that publishes to an SNS topic invoking Lambda.

Answer

Send VPC Flow Logs to an S3 bucket and schedule an hourly Athena query, using EventBridge Scheduler to run a Lambda function that parses the query results.

Answer

Send VPC Flow Logs to an S3 bucket and enable S3 Event Notifications so that each new log object triggers Lambda to scan for the malicious IP.

Answer

Send VPC Flow Logs to Kinesis Data Firehose and configure a daily Glue crawler to catalog the data before querying with Athena.