VPC Flow Logs

Docs > DDSQL Reference > Data Directory > VPC Flow Logs

This table represents the VPC Flow Logs resource from Amazon Web Services.

aws.vpc_flow_log

Fields

ID	Type	Data Type	Description
_key	core	string
account_id	core	string
creation_time	core	timestamp	The date and time the flow log was created.
deliver_cross_account_role	core	string	The ARN of the IAM role that allows the service to publish flow logs across accounts.
deliver_logs_error_message	core	string	Information about the error that occurred. <code>Rate limited</code> indicates that CloudWatch Logs throttling has been applied for one or more network interfaces, or that you've reached the limit on the number of log groups that you can create. <code>Access error</code> indicates that the IAM role associated with the flow log does not have sufficient permissions to publish to CloudWatch Logs. <code>Unknown error</code> indicates an internal error.
deliver_logs_permission_arn	core	string	The ARN of the IAM role allows the service to publish logs to CloudWatch Logs.
deliver_logs_status	core	string	The status of the logs delivery (<code>SUCCESS</code> \| <code>FAILED</code>).
destination_options	core	json	The destination options.
flow_log_arn	core	string
flow_log_id	core	string	The ID of the flow log.
flow_log_status	core	string	The status of the flow log (<code>ACTIVE</code>).
log_destination	core	string	The Amazon Resource Name (ARN) of the destination for the flow log data.
log_destination_type	core	string	The type of destination for the flow log data.
log_format	core	string	The format of the flow log record.
log_group_name	core	string	The name of the flow log group.
max_aggregation_interval	core	int64	The maximum interval of time, in seconds, during which a flow of packets is captured and aggregated into a flow log record. When a network interface is attached to a <a href="https://docs.aws.amazon.com/ec2/latest/instancetypes/ec2-nitro-instances.html">Nitro-based instance</a>, the aggregation interval is always 60 seconds (1 minute) or less, regardless of the specified value. Valid Values: <code>60</code> \| <code>600</code>
resource_id	core	string	The ID of the resource being monitored.
tags	core	hstore
traffic_type	core	string	The type of traffic captured for the flow log.