Detect Suspicious Network Traffic with VPC Flow Logs

Enable VPC Flow Logs and send them to Amazon CloudWatch Logs to capture real network traffic inside your VPC. You will explore the structure of flow log records, identify accepted and rejected connections, and use CloudWatch Logs Insights to run queries that surface suspicious or high-volume rejected traffic. By the end of this lab, you will understand how VPC Flow Logs help with network troubleshooting, threat detection, and security investigations in real-world AWS environments.