> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon VPC Flow Logs

> Connect your AWS account so Sazabi creates a flow log for each VPC you pick and streams its network traffic records in through CloudWatch Logs.

[All AWS integration capabilities](https://docs.sazabi.com/catalogs/integrations/aws)

## About

Connect your AWS account and Sazabi creates a flow log for each VPC you pick. Each flow log records every accepted and rejected flow of the VPC's network interfaces at a 1-minute aggregation interval and publishes to a CloudWatch Logs group, and a subscription filter forwards each record to Sazabi. Every flow log field (addresses, ports, protocol, packets, bytes, action, VPC, subnet, instance and AWS service) becomes a searchable log attribute.

Sazabi uses the same `SazabiLogIngestion` IAM role as the [CloudWatch log source](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/cloudwatch.md), so one role serves both.

If you'd rather not grant Sazabi a role, choose **Send data to an endpoint** in the dashboard instead: publish your flow logs to a CloudWatch Logs group yourself and run an OpenTelemetry Collector (`opentelemetry-collector-contrib`) with the `awscloudwatch` receiver reading that group and an `otlphttp` exporter pointed at the intake URL the dashboard shows. On that path each record is stored as its text line rather than as separate fields.

## Prerequisites

* Permission to create IAM roles and attach inline policies (`iam:CreateRole`, `iam:PutRolePolicy`).
* VPCs in the same AWS region as your Sazabi project.

AWS bills CloudWatch Logs ingestion for every flow log record, on top of Sazabi usage. Sazabi sets a 1-day retention period on the log groups it creates so the records aren't stored twice.

## Set up in the dashboard

**Step 1**

### Grant the IAM permissions

Go to [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers), click **Add source**, and select **Amazon VPC Flow Logs**. Choose **Terraform** or **CLI** and run the snippet. It embeds your project's Sazabi account ID and external ID, and:

* adds a `SazabiVpcFlowLogsManagement` policy to the `SazabiLogIngestion` role (creating the role if you haven't connected CloudWatch), letting Sazabi list VPCs, create flow logs, delete the flow logs it tagged `ManagedBy=Sazabi`, and manage log groups under `/sazabi/vpc-flow-logs/`;
* creates a `SazabiVpcFlowLogsDelivery` role that VPC Flow Logs uses to write records to those log groups.

**Step 2**

### Enter the role ARN

Paste the `SazabiLogIngestion` role ARN and click **Connect**. Sazabi assumes the role and checks that it can list your VPCs.

**Step 3**

### Pick VPCs

Click **Add log stream**. The picker lists the VPCs in your project's region with their network interface count and any flow logs they already have. For each VPC you pick, Sazabi creates the log group `/sazabi/vpc-flow-logs/VPC_ID`, the flow log and the subscription filter. Removing the log stream deletes all three.

## Set up with the CLI

The connection is best created in the dashboard: the IAM role's trust policy must reference the Sazabi-generated external ID that the setup snippets embed for your project. Once it exists, add a VPC and manage the source from the [Sazabi CLI](https://docs.sazabi.com/reference/cli/log-sources.md):

```bash theme={"system"}
sazabi log-sources list --provider aws_vpc_flow_logs   # Find the log source ID
sazabi log-streams create --log-source-id LOG_SOURCE_ID --config '{"vpcId":"vpc-0123456789abcdef0"}'
sazabi log-sources get LOG_SOURCE_ID                   # Log source details and its log streams
sazabi log-sources disable LOG_SOURCE_ID               # Pause ingestion
```

## Verify

Flow log records reach CloudWatch Logs about five minutes after the traffic. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) and confirm records attributed to **Amazon VPC Flow Logs** appear, or ask for rejected traffic:

```bash theme={"system"}
sazabi logs ask "Show VPC flow log records with aws.vpc.flow.action REJECT in the last 30 minutes"
```

## Troubleshooting

**"can't list your VPCs" when connecting**: the `SazabiVpcFlowLogsManagement` policy is missing from the role. Re-run the setup snippet.

**Log stream error naming `SazabiVpcFlowLogsDelivery`**: the delivery role is missing or doesn't trust `vpc-flow-logs.amazonaws.com`. Re-run the setup snippet, then retry the log stream.

**"already has the most flow logs AWS allows"**: the VPC is at AWS's flow log limit per resource. Delete one of its flow logs, then retry.

**No records**: VPC Flow Logs don't record traffic to the Amazon DNS server, the instance metadata service, Amazon Time Sync, DHCP or Windows license activation. Check the flow log's status on the VPC's **Flow logs** tab in the EC2 console.

## Further reading

> [card] [CloudWatch](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/cloudwatch.md)
>
> Forward any CloudWatch log group with the same IAM role.

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.