VPC Flow Logs are AWS network logs that record IP traffic to and from interfaces in a Virtual Private Cloud. They capture metadata such as source and destination addresses, ports, protocol, traffic direction, and whether the connection was accepted or rejected. They do not show packet contents, but they do reveal how systems communicate.
In cyber security, these logs are valuable for spotting unusual network behavior after credential theft or malware execution. Defenders use them to identify unexpected outbound connections, suspicious lateral movement, data transfer patterns, or traffic to rare destinations. In investigations, VPC Flow Logs help confirm whether an alert was followed by real network activity and provide context that can be correlated with CloudTrail, DNS logs, and other telemetry. Because they are lightweight and broad in coverage, they are a core source for reconstructing attack paths in AWS environments.