CmdID / aws / aws ec2

aws ec2 create-flow-logs

Creates one or more flow logs to capture information about IP traffic for a specific network interface, subnet, or VPC. AWS CLI reference

3 examples 15 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

Example 1: To create a flow log

The following create-flow-logs example creates a flow log that captures all rejected traffic for the specified network interface. The flow logs are delivered to a log group in CloudWatch Logs using the permissions in the specified IAM role.

aws ec2 create-flow-logs --resource-type NetworkInterface --resource-ids eni-11223344556677889 --traffic-type REJECT --log-group-name my-flow-logs --deliver-logs-permission-arn arn:aws:iam::123456789012:role/publishFlowLogs

Identify

--resource-typeThe type of resource to monitor.

--resource-idsThe IDs of the resources to monitor.

--traffic-typeThe type of traffic to monitor (accepted traffic, rejected traffic, or all traffic).

--log-group-nameThe name of a new or existing CloudWatch Logs log group where Amazon EC2 publishes your flow logs.

--deliver-logs-permission-arnThe ARN of the IAM role that allows Amazon EC2 to publish flow logs to the log destination.

Its output

{
    "ClientToken": "so0eNA2uSHUNlHI0S2cJ305GuIX1CezaRdGtexample",
    "FlowLogIds": [
        "fl-12345678901234567"
    ],
    "Unsuccessful": []
}

For more information, see VPC Flow Logs in the Amazon VPC User Guide.

Example 2: To create a flow log with a custom format

The following create-flow-logs example creates a flow log that captures all traffic for the specified VPC and delivers the flow logs to an Amazon S3 bucket. The --log-format parameter specifies a custom format for the flow log records. To run this command on Windows, change the single quotes (') to double quotes (").

aws ec2 create-flow-logs --resource-type VPC --resource-ids vpc-00112233344556677 --traffic-type ALL --log-destination-type s3 --log-destination arn:aws:s3:::amzn-s3-demo-bucket/my-custom-flow-logs/ --log-format '${version} ${vpc-id} ${subnet-id} ${instance-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${tcp-flags} ${type} ${pkt-srcaddr} ${pkt-dstaddr}'

Identify

--resource-typeThe type of resource to monitor.

--resource-idsThe IDs of the resources to monitor.

--traffic-typeThe type of traffic to monitor (accepted traffic, rejected traffic, or all traffic).

--log-destination-typeThe type of destination for the flow log data.

--log-destinationThe destination for the flow log data.

--log-formatThe fields to include in the flow log record.

Its output

{
    "ClientToken": "so0eNA2uSHUNlHI0S2cJ305GuIX1CezaRdGtexample",
    "FlowLogIds": [
        "fl-1a2b3c4d5e6f7a8b9"
    ],
    "Unsuccessful": []
}

For more information, see VPC Flow Logs in the Amazon VPC User Guide.

Example 3: To create a flow log with a one-minute maximum aggregation interval

The following create-flow-logs example creates a flow log that captures all traffic for the specified VPC and delivers the flow logs to an Amazon S3 bucket. The --max-aggregation-interval parameter specifies a maximum aggregation interval of 60 seconds (1 minute).

aws ec2 create-flow-logs --resource-type VPC --resource-ids vpc-00112233344556677 --traffic-type ALL --log-destination-type s3 --log-destination arn:aws:s3:::amzn-s3-demo-bucket/my-custom-flow-logs/ --max-aggregation-interval 60

Identify

--resource-typeThe type of resource to monitor.

--resource-idsThe IDs of the resources to monitor.

--traffic-typeThe type of traffic to monitor (accepted traffic, rejected traffic, or all traffic).

--log-destination-typeThe type of destination for the flow log data.

--log-destinationThe destination for the flow log data.

--max-aggregation-intervalThe maximum interval of time during which a flow of packets is captured and aggregated into a flow log record.

Its output

{
    "ClientToken": "so0eNA2uSHUNlHI0S2cJ305GuIX1CezaRdGtexample",
    "FlowLogIds": [
        "fl-0a1b2c3d4e5f6a7b8"
    ],
    "Unsuccessful": []
}

For more information, see VPC Flow Logs in the Amazon VPC User Guide.

Options

15 in the AWS CLI reference

--client-tokenUnique, case-sensitive identifier that you provide to ensure the idempotency of the request.

--deliver-cross-account-roleThe ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts.

--deliver-logs-permission-arnThe ARN of the IAM role that allows Amazon EC2 to publish flow logs to the log destination.

--destination-optionsThe destination options.

--dry-runChecks whether you have the required permissions for the action, without actually making the request, and provides an error response.

--log-destination-typeThe type of destination for the flow log data.

--log-destinationThe destination for the flow log data.

--log-formatThe fields to include in the flow log record.

--log-group-nameThe name of a new or existing CloudWatch Logs log group where Amazon EC2 publishes your flow logs.

--max-aggregation-intervalThe maximum interval of time during which a flow of packets is captured and aggregated into a flow log record.

--resource-idsThe IDs of the resources to monitor.

--resource-typeThe type of resource to monitor.

--tag-field-specificationsThe tag configuration associated with the Flow Logs Amazon EC2 Tags feature fields in your custom log format.

--tag-specificationsThe tags to apply to the flow logs.

--traffic-typeThe type of traffic to monitor (accepted traffic, rejected traffic, or all traffic).