> ## Documentation Index > Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt > Use this file to discover all available pages before exploring further. # VPC Flow Logs > AWS VPC Flow Logs. Records metadata about accepted and rejected IP traffic on a VPC, subnet or network interface, delivered to CloudWatch Logs, S3 or Firehose. Preview **On this page** * [Coverage by target cloud](#coverage-by-target-cloud) * [How the targets compare](#how-the-targets-compare) * [Max adaptation](#max-adaptation) * [Infrastructure-only adaptation](#infrastructure-only-adaptation) * [On Google Cloud](#on-google-cloud) ## Coverage by target cloud | Target | Available | | ------------------ | --------- | | Google Cloud | ✓ | | Azure | - | | OCI | - | | Private Kubernetes | - | ## How the targets compare Each row compares a capability of VPC Flow Logs with its adaptation on each target. A dash means this row is not stated for that target. ### Max adaptation | Capability | VPC Flow Logs | Google Cloud | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------- | | Where records land | a CloudWatch log group, an S3 bucket or a Firehose stream | Cloud Logging, log `compute.googleapis.com/vpc_flows` on the subnetwork | | Record format | one space-separated line per flow (version 2: version, account-id, interface-id, srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, start, end, action, log-status) | one JSON entry per flow (connection 5-tuple, reporter, bytes\_sent, packets\_sent, start\_time, end\_time, rtt\_msec) | | Which flows are recorded | every flow the interface sees, ACCEPT and REJECT, filterable to one | sampled flows of every disposition | | Aggregation window | 60 or 600 seconds (600 by default) | 1-minute or 10-minute interval, mapped exactly | | Capture scope | a VPC, a subnet or a network interface | a subnetwork, or every subnetwork of the network | | Retention and query | the log group's retention; CloudWatch Logs Insights, or Athena over S3 | the project's log bucket: 30 days by default, 1 to 3650 days; Logs Explorer, Log Analytics, sinks | | API coverage | full | partial | ### Infrastructure-only adaptation | Capability | VPC Flow Logs | Google Cloud | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------- | | Where records land | a CloudWatch log group, an S3 bucket or a Firehose stream | Cloud Logging, log `compute.googleapis.com/vpc_flows` on the subnetwork | | Record format | one space-separated line per flow (version 2: version, account-id, interface-id, srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, start, end, action, log-status) | one JSON entry per flow (connection 5-tuple, reporter, bytes\_sent, packets\_sent, start\_time, end\_time, rtt\_msec) | | Which flows are recorded | every flow the interface sees, ACCEPT and REJECT, filterable to one | sampled flows of every disposition | | Aggregation window | 60 or 600 seconds (600 by default) | 1-minute or 10-minute interval, mapped exactly | | Capture scope | a VPC, a subnet or a network interface | a subnetwork, or every subnetwork of the network | | Retention and query | the log group's retention; CloudWatch Logs Insights, or Athena over S3 | the project's log bucket: 30 days by default, 1 to 3650 days; Logs Explorer, Log Analytics, sinks | | API coverage | full | partial | ## On Google Cloud | Capability | Area | Support | Required tier | Operations | Notes | | ----------------------- | ------- | -------------- | ------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ACCEPT / REJECT capture | Records | Out of scope | - | - | a subnetwork logs every disposition and offers no switch, so a flow log that asks for REJECT or ACCEPT only is refused; inbound packets an ingress firewall rule denies are not sampled on Google Cloud at all, and Firewall Rules Logging is the native record of those | | Aggregation window | Records | Supported | - | - | 60 and 600 seconds map to the 1-minute and 10-minute subnetwork intervals exactly | | Record destination | Records | Adapter-served | - | - | records are Cloud Logging entries under the log `compute.googleapis.com/vpc_flows`, one per subnetwork, in Google's JSON schema; the CloudWatch log group, S3 bucket or Firehose stream the request names is neither created nor written, and a consumer reading it sees an empty destination | | Record format | Records | Partial | - | - | a Cloud Logging entry carries the connection 5-tuple, reporter, bytes\_sent, packets\_sent, start\_time and end\_time (RFC 3339) and rtt\_msec; the AWS fields account-id, interface-id, action and log-status have no counterpart, the capture is configured without Google's own annotations (instance, VPC and location names), and a custom LogFormat is stored and echoed but does not shape the entries | | Retention and query | Records | Partial | - | - | records sit in the project's log bucket, 30 days by default and configurable from 1 to 3650 days, queried in Logs Explorer or Log Analytics and exportable through a sink to BigQuery, Cloud Storage or Pub/Sub; nothing in the EC2 request sets any of that, and the AWS log group's retention does not apply | | Sampling | Records | Partial | - | - | AWS records every flow the interface sees; a Google Cloud subnetwork samples. The capture is configured at 100 percent secondary sampling, where Google's default is 50 percent, but Google's primary sampling varies with host load and cannot be set, so byte and packet counts are estimates from sampled packets | | Operation | Area | Support | Depth | Notes | | ------------------------------ | -------- | ------------ | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | GetFlowLogsIntegrationTemplate | Analysis | Out of scope | Full surface | The Athena integration template is not served. Query the records in Cloud Logging, or export them through a sink. | | CreateFlowLogs | Capture | Partial | Common | Accepted for a VPC or a subnet and realized as flow logging on the matching Compute Engine subnetworks; a VPC-scoped flow log enables every subnetwork of that network. TrafficType ALL, a MaxAggregationInterval of 60 or 600 seconds (600 when omitted, as on EC2), tags and a ClientToken carry. The request must name a destination the way EC2 requires (a delivery role for CloudWatch Logs, or a LogDestination or LogGroupName), and that destination cannot be written from Google Cloud, so the request is refused until the deployment acknowledges that the records land in Cloud Logging instead. A flow log on a network interface, a TrafficType of ACCEPT or REJECT, a second flow log on a subnetwork that already has one, DestinationOptions, DeliverCrossAccountRole and TagFieldSpecifications are refused. | | DeleteFlowLogs | Capture | Supported | Common | Withdraws the capture; a subnetwork no flow log watches any longer has its logging disabled. An unknown id answers InvalidFlowLogId.NotFound for that item while the rest of the batch succeeds, as on EC2. | | DescribeFlowLogs | Capture | Supported | Common | Returns each flow log as it was accepted: its `fl-` id, the monitored resource, traffic type, aggregation interval, the destination the request named and its tags, by id or with filters. It reports the capture as requested and does not read Cloud Logging, so delivery health is something you check in Cloud Logging. | #### From CreateFlowLogs to a subnetwork capture CreateFlowLogs is checked the way EC2 checks it (a resource to watch, a traffic type in ALL / ACCEPT / REJECT, an interval of 60 or 600 seconds, a destination), given `fl-` ids and recorded. The capture is then written onto the Compute Engine subnetworks it covers as their flow-log configuration: enabled, with sampling set to 100 percent, at the interval you asked for. A flow log on the VPC covers every subnetwork of that network; a flow log on a subnet covers that one. DescribeFlowLogs answers from the record, and DeleteFlowLogs disables the subnetwork's logging once no flow log watches it. Two requests are refused because Google Cloud cannot mean what they ask: a flow log on a single network interface (a subnetwork capture would record every neighbour's flows too) and a flow log restricted to ACCEPT or REJECT (a subnetwork logs both and has no switch). A second flow log on a subnetwork already captured is refused as well, since one configuration cannot answer for two captures with different settings. #### What a consumer reads in Cloud Logging Each record is a Cloud Logging entry under `compute.googleapis.com/vpc_flows`: the connection 5-tuple, which side reported it, bytes and packets sent, the start and end of the aggregation window as RFC 3339 timestamps, and the round-trip time for TCP. Compared with the AWS line, the account id, the interface id, the ACCEPT/REJECT `action` and the OK/NODATA/SKIPDATA `log-status` are gone, timestamps change format, and a custom LogFormat you set is echoed by DescribeFlowLogs but changes nothing in the entries. The capture is configured without Google's own annotations, so entries do not carry instance, VPC or location names either. Counts are estimates. Google samples flows on the host with a rate it varies under load and does not expose; the capture asks for 100 percent of what remains, where Google's default is 50 percent. A consumer that meters bytes or packets from flow records is reading a sample. Inbound packets an ingress firewall rule denies are not sampled at all, so the REJECT records AWS would have written for them have no counterpart; Firewall Rules Logging, configured on Google Cloud, is where denied inbound traffic is recorded. Retention and query are Cloud Logging's: the project's log bucket keeps entries 30 days by default and can be set from 1 to 3650 days; Logs Explorer and Log Analytics query them, and a sink exports them to BigQuery, Cloud Storage or Pub/Sub. The retention you set on a CloudWatch log group does not travel. #### Limitations * **The AWS destination is never written.** The CloudWatch log group, S3 bucket or Firehose stream the request names is an address the record carries; the entries go to Cloud Logging, and the request is refused until the deployment acknowledges that change of sink. - **No per-interface capture.** A flow log on a network interface is refused; capture the subnet instead and filter by address downstream. - **No ACCEPT-only or REJECT-only capture.** A subnetwork logs both dispositions, and the entries carry no `action` field to filter on. Denied inbound packets are not sampled at all. - **One capture per subnetwork.** A second flow log on a subnetwork that already has one is refused. - **Counts are sampled.** Google's primary sampling varies with host load; byte and packet totals are estimates. - **A custom LogFormat has no effect** on the entries, and the Athena integration template is not served. #### Other considerations * **Consumers change first.** Parsers move from the space-separated AWS line to JSON entries, and logic keyed on `interface-id`, `action` or `log-status` needs another source; the migration note above lists the changes. - **Delivery health is read in Cloud Logging.** DescribeFlowLogs echoes the request; it does not observe whether entries are arriving. - **Cost lands on Google Cloud.** Flow-log generation and Cloud Logging ingestion and retention are billed by Google; there is no CloudWatch Logs charge. **Sources** · [AWS flow log records ↗](https://docs.aws.amazon.com/vpc/latest/userguide/flow-log-records.html) · [Google Cloud VPC Flow Logs ↗](https://cloud.google.com/vpc/docs/flow-logs) · [VPC Flow Logs record format ↗](https://cloud.google.com/vpc/docs/about-flow-logs-records) · [Cloud Logging buckets and retention ↗](https://cloud.google.com/logging/docs/buckets) [Service Catalog](/byoc/service-adapters/catalog).