AWS vpc documentation change
Summary
Added troubleshooting section for flow logs data size mismatch with billing data, including SKIPDATA entries explanation and sample queries
Security assessment
The change addresses data discrepancy issues related to SKIPDATA entries in flow logs, which is an operational/troubleshooting matter rather than a security vulnerability. No evidence of addressing exploits or vulnerabilities.
Diff
diff --git a/vpc/latest/userguide/flow-logs-troubleshooting.md b/vpc/latest/userguide/flow-logs-troubleshooting.md index 4c2c8146d..7c6f4e70c 100644 --- a//vpc/latest/userguide/flow-logs-troubleshooting.md +++ b//vpc/latest/userguide/flow-logs-troubleshooting.md @@ -5 +5 @@ -Incomplete flow log recordsFlow log is active, but no flow log records or log group'LogDestinationNotFoundException' or 'Access Denied for LogDestination' errorExceeding the Amazon S3 bucket policy limitLogDestination undeliverable +Incomplete flow log recordsFlow log is active, but no flow log records or log group'LogDestinationNotFoundException' or 'Access Denied for LogDestination' errorExceeding the Amazon S3 bucket policy limitLogDestination undeliverableFlow logs data size mismatch with billing data @@ -22,0 +23,2 @@ The following are possible issues you might have when working with flow logs. + * Flow logs data size mismatch with billing data + @@ -30 +32 @@ The following are possible issues you might have when working with flow logs. -Your flow log records are incomplete, or are no longer being published. +Your flow log records are incomplete or are no longer being published. @@ -34 +36 @@ Your flow log records are incomplete, or are no longer being published. -There might be a problem delivering the flow logs to the CloudWatch Logs log group. +There might be a problem delivering the flow logs to the CloudWatch Logs log group or [SkipData entries may be present](./flow-logs-records-examples.html#flow-log-example-no-data). @@ -140,0 +143,33 @@ The value must be a KMS key ARN. Change the default S3 encryption type from KMS +## Flow logs data size mismatch with billing data + +###### Problem + +The total data size of your flow logs does not match the size reported by billing data. + +###### Possible causes + +There may be SKIPDATA entries in your flow logs. See [No data and skipped records](./flow-logs-records-examples.html#flow-log-example-no-data) for an explanation of SKIPDATA entries. + +###### Solution + +Confirm that SKIPDATA entries are present in your log entries by querying your logs for different entries in the log-status field. + +Sample queries to check for SKIPDATA: + +CW Insights: + + + fields @timestamp, @message, @logStream, @log + | filter interfaceId = 'eni-123' + | stats count(*) by interfaceId, logStatus + | sort by interfaceId, logStatus + + +Athena: + + + SELECT log_status, interface_id, count(1) + FROM vpc_flow_logs + WHERE interface_id IN ('eni-1', 'eni-2', 'eni-3') + GROUP BY log_status, interface_id +