Question

A security engineer needs to analyze traffic flowing between VPCs that are interconnected through an AWS Transit Gateway. VPC Flow Logs are already enabled on each individual VPC, but the engineer finds it difficult to correlate traffic because the logs do not indicate which Transit Gateway attachment or route table processed the packets. The team wants a single, centralized source of flow data that captures traffic at the Transit Gateway level with attachment-level context, delivered for querying in Amazon Athena. What should the engineer do?

Accepted Answer

Enable Transit Gateway Flow Logs on the Transit Gateway resource and configure delivery to an S3 bucket, then query the logs with Athena.

Answer

Enable VPC Flow Logs at the subnet level in every VPC and aggregate the records into a single S3 bucket for Athena analysis.

Answer

Enable ENI-level VPC Flow Logs on the Transit Gateway attachment elastic network interfaces and merge them in CloudWatch Logs.

Answer

Enable Traffic Mirroring on the Transit Gateway attachments and send the captured packets to a monitoring appliance for analysis.