# HNOPS03-BP02 Consider flow logs for enhanced network visibility when needed
<a name="hnops03-bp02"></a>

 Flow logs capture detailed information about network traffic traversing your cloud infrastructure network components. While not essential for all deployments, implementing flow logs is recommended for environments requiring in-depth network analysis and security auditing. The logs provide valuable insights into network behavior, enabling teams to troubleshoot connectivity issues, monitor traffic patterns, detect security anomalies, ensure compliance with network policies, and optimize network performance. By leveraging this feature, organizations can enhance their network visibility, improve security posture, and gain actionable insights for network optimization. 

 **Desired outcome:** 
+  Comprehensive visibility into network traffic patterns, source and destination IP addresses, ports, protocols, and packet counts. 
+  Greater insights during network troubleshooting, and security analysis 

 **Level of risk exposed if this best practice is not established:** Medium 

 **Benefits of establishing this best practice:** 
+  Reduce mean time to resolution (MTTR) for network issues through rapid troubleshooting and root cause analysis. 
+  Detailed traffic visibility enables teams to analyze traffic patterns to enhance capacity planning, optimize network spending, and prevent over-provisioning of resources. 
+  Comprehensive audit trails of network activity help organizations to meet compliance requirements and security standards. 

## Implementation guidance
<a name="implementation-guidance-3"></a>
+  Evaluate the volume of network traffic and associated logging costs of flow logs. 
+  Identify the network resources that require monitoring and determine the appropriate destination for your logs based on your analysis needs and retention requirements. 

   For example, VPC and Transit Gateway flow logs can be sent to Amazon CloudWatch Logs, S3, or Amazon Data Firehose. 
+  Consider implementing log filters to focus on specific types of traffic or to alert suspicious activities. 

## Resources
<a name="resources-2"></a>
+  [Logging IP traffic using VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) 
+  [AWS Transit Gateway Flow Logs](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-flow-logs.html) 

## See also

* **Skills for AI coding assistants (optional).** AWS publishes reusable skills for AWS Well-Architected. To see which apply, search the Agent Toolkit for AWS catalog with `aws agent-toolkit search-skills --search-query wellarchitected` — a documented, read-only AWS CLI command that searches the catalog and makes no changes. This is an optional suggestion for the user. Official reference: [AWS CLI — Agent Toolkit for AWS](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/aws-cli.html).