Skip to main content
All AWS integration capabilities

​
About

Connect your AWS account and Sazabi creates a flow log for each VPC you pick. Each flow log records every accepted and rejected flow of the VPC’s network interfaces at a 1-minute aggregation interval and publishes to a CloudWatch Logs group, and a subscription filter forwards each record to Sazabi. Every flow log field (addresses, ports, protocol, packets, bytes, action, VPC, subnet, instance and AWS service) becomes a searchable log attribute. Sazabi uses the same SazabiLogIngestion IAM role as the CloudWatch log source, so one role serves both. If you’d rather not grant Sazabi a role, choose Send data to an endpoint in the dashboard instead: publish your flow logs to a CloudWatch Logs group yourself and run an OpenTelemetry Collector (opentelemetry-collector-contrib) with the awscloudwatch receiver reading that group and an otlphttp exporter pointed at the intake URL the dashboard shows. On that path each record is stored as its text line rather than as separate fields.

​
Prerequisites

  • Permission to create IAM roles and attach inline policies (iam:CreateRole, iam:PutRolePolicy).
  • VPCs in the same AWS region as your Sazabi project.
AWS bills CloudWatch Logs ingestion for every flow log record, on top of Sazabi usage. Sazabi sets a 1-day retention period on the log groups it creates so the records aren’t stored twice.

​
Set up in the dashboard

1

​
Grant the IAM permissions

Go to Settings > Log streams, click Add source, and select Amazon VPC Flow Logs. Choose Terraform or CLI and run the snippet. It embeds your project’s Sazabi account ID and external ID, and:
  • adds a SazabiVpcFlowLogsManagement policy to the SazabiLogIngestion role (creating the role if you haven’t connected CloudWatch), letting Sazabi list VPCs, create flow logs, delete the flow logs it tagged ManagedBy=Sazabi, and manage log groups under /sazabi/vpc-flow-logs/;
  • creates a SazabiVpcFlowLogsDelivery role that VPC Flow Logs uses to write records to those log groups.
2

​
Enter the role ARN

Paste the SazabiLogIngestion role ARN and click Connect. Sazabi assumes the role and checks that it can list your VPCs.
3

​
Pick VPCs

Click Add log stream. The picker lists the VPCs in your project’s region with their network interface count and any flow logs they already have. For each VPC you pick, Sazabi creates the log group /sazabi/vpc-flow-logs/VPC_ID, the flow log and the subscription filter. Removing the log stream deletes all three.

​
Set up with the CLI

The connection is best created in the dashboard: the IAM role’s trust policy must reference the Sazabi-generated external ID that the setup snippets embed for your project. Once it exists, add a VPC and manage the source from the Sazabi CLI:

​
Verify

Flow log records reach CloudWatch Logs about five minutes after the traffic. Open the Intake page and confirm records attributed to Amazon VPC Flow Logs appear, or ask for rejected traffic:

​
Troubleshooting

“can’t list your VPCs” when connecting: the SazabiVpcFlowLogsManagement policy is missing from the role. Re-run the setup snippet. Log stream error naming SazabiVpcFlowLogsDelivery: the delivery role is missing or doesn’t trust vpc-flow-logs.amazonaws.com. Re-run the setup snippet, then retry the log stream. “already has the most flow logs AWS allows”: the VPC is at AWS’s flow log limit per resource. Delete one of its flow logs, then retry. No records: VPC Flow Logs don’t record traffic to the Amazon DNS server, the instance metadata service, Amazon Time Sync, DHCP or Windows license activation. Check the flow log’s status on the VPC’s Flow logs tab in the EC2 console.

​
Further reading

CloudWatch

Forward any CloudWatch log group with the same IAM role.

Intake

See per-source ingestion volume and health in the Intake page.