Question

Your security team wants to analyze traffic between two specific subnets in a production VPC without incurring the full cost of logging every flow. They need the exported logs to include the destination Google service name and the geographic region of external endpoints so they can build BigQuery reports. VPC Flow Logs are currently enabled with default settings on the relevant subnet. What is the most cost-effective way to meet these requirements?

Accepted Answer

Reconfigure the subnet's VPC Flow Logs to use a log filter expression that matches only traffic between the two subnets and set metadata to INCLUDE_ALL_METADATA (or specify the needed metadata fields).

Answer

Enable Firewall Rules Logging on the subnet's firewall rules and disable VPC Flow Logs, since firewall logs contain service and geographic annotations.

Answer

Lower the aggregation interval to 5 seconds and set the sampling rate to 1.0 so that all metadata is captured for the two subnets.

Answer

Use Packet Mirroring to capture full packet payloads between the two subnets and export the mirrored traffic to BigQuery for analysis.