Coverage by target cloud
How the targets compare
Each row compares a capability of VPC Flow Logs with its adaptation on each target. A dash means this row is not stated for that target.Max adaptation
Infrastructure-only adaptation
On Google Cloud
From CreateFlowLogs to a subnetwork capture
CreateFlowLogs is checked the way EC2 checks it (a resource to watch, a traffic type in ALL / ACCEPT / REJECT, an interval of 60 or 600 seconds, a destination), givenfl- ids and recorded. The capture is then written onto the Compute Engine subnetworks it covers as their flow-log configuration: enabled, with sampling set to 100 percent, at the interval you asked for. A flow log on the VPC covers every subnetwork of that network; a flow log on a subnet covers that one. DescribeFlowLogs answers from the record, and DeleteFlowLogs disables the subnetwork’s logging once no flow log watches it.
Two requests are refused because Google Cloud cannot mean what they ask: a flow log on a single network interface (a subnetwork capture would record every neighbour’s flows too) and a flow log restricted to ACCEPT or REJECT (a subnetwork logs both and has no switch). A second flow log on a subnetwork already captured is refused as well, since one configuration cannot answer for two captures with different settings.
What a consumer reads in Cloud Logging
Each record is a Cloud Logging entry undercompute.googleapis.com/vpc_flows: the connection 5-tuple, which side reported it, bytes and packets sent, the start and end of the aggregation window as RFC 3339 timestamps, and the round-trip time for TCP. Compared with the AWS line, the account id, the interface id, the ACCEPT/REJECT action and the OK/NODATA/SKIPDATA log-status are gone, timestamps change format, and a custom LogFormat you set is echoed by DescribeFlowLogs but changes nothing in the entries. The capture is configured without Google’s own annotations, so entries do not carry instance, VPC or location names either.
Counts are estimates. Google samples flows on the host with a rate it varies under load and does not expose; the capture asks for 100 percent of what remains, where Google’s default is 50 percent. A consumer that meters bytes or packets from flow records is reading a sample. Inbound packets an ingress firewall rule denies are not sampled at all, so the REJECT records AWS would have written for them have no counterpart; Firewall Rules Logging, configured on Google Cloud, is where denied inbound traffic is recorded.
Retention and query are Cloud Logging’s: the project’s log bucket keeps entries 30 days by default and can be set from 1 to 3650 days; Logs Explorer and Log Analytics query them, and a sink exports them to BigQuery, Cloud Storage or Pub/Sub. The retention you set on a CloudWatch log group does not travel.
Limitations
- The AWS destination is never written. The CloudWatch log group, S3 bucket or Firehose stream the request names is an address the record carries; the entries go to Cloud Logging, and the request is refused until the deployment acknowledges that change of sink. - No per-interface capture. A flow log on a network interface is refused; capture the subnet instead and filter by address downstream. - No ACCEPT-only or REJECT-only capture. A subnetwork logs both dispositions, and the entries carry no
actionfield to filter on. Denied inbound packets are not sampled at all. - One capture per subnetwork. A second flow log on a subnetwork that already has one is refused. - Counts are sampled. Google’s primary sampling varies with host load; byte and packet totals are estimates. - A custom LogFormat has no effect on the entries, and the Athena integration template is not served.
Other considerations
- Consumers change first. Parsers move from the space-separated AWS line to JSON entries, and logic keyed on
interface-id,actionorlog-statusneeds another source; the migration note above lists the changes. - Delivery health is read in Cloud Logging. DescribeFlowLogs echoes the request; it does not observe whether entries are arriving. - Cost lands on Google Cloud. Flow-log generation and Cloud Logging ingestion and retention are billed by Google; there is no CloudWatch Logs charge.