---
title: VPC Flow Log
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > DDSQL Reference > Data Directory > VPC Flow Log
---

# VPC Flow Log

This table represents the VPC Flow Log resource from Amazon Web Services.

```
aws.vpc_flow_log
```

## Fields

| Title                       | ID   | Type       | Data Type                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Description |
| --------------------------- | ---- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
| _key                        | core | string     |
| account_id                  | core | string     |
| creation_time               | core | timestamp  | The date and time the flow log was created.                                                                                                                                                                                                                                                                                                                                                                                                                          |
| deliver_cross_account_role  | core | string     | The ARN of the IAM role that allows the service to publish flow logs across accounts.                                                                                                                                                                                                                                                                                                                                                                                |
| deliver_logs_error_message  | core | string     | Information about the error that occurred. <code>Rate limited</code> indicates that CloudWatch Logs throttling has been applied for one or more network interfaces, or that you've reached the limit on the number of log groups that you can create. <code>Access error</code> indicates that the IAM role associated with the flow log does not have sufficient permissions to publish to CloudWatch Logs. <code>Unknown error</code> indicates an internal error. |
| deliver_logs_permission_arn | core | string     | The ARN of the IAM role allows the service to publish logs to CloudWatch Logs.                                                                                                                                                                                                                                                                                                                                                                                       |
| deliver_logs_status         | core | string     | The status of the logs delivery (<code>SUCCESS</code> | <code>FAILED</code>).                                                                                                                                                                                                                                                                                                                                                                                        |
| destination_options         | core | json       | The destination options.                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| flow_log_arn                | core | string     |
| flow_log_id                 | core | string     | The ID of the flow log.                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| flow_log_status             | core | string     | The status of the flow log (<code>ACTIVE</code>).                                                                                                                                                                                                                                                                                                                                                                                                                    |
| log_destination             | core | string     | The Amazon Resource Name (ARN) of the destination for the flow log data.                                                                                                                                                                                                                                                                                                                                                                                             |
| log_destination_type        | core | string     | The type of destination for the flow log data.                                                                                                                                                                                                                                                                                                                                                                                                                       |
| log_format                  | core | string     | The format of the flow log record.                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| log_group_name              | core | string     | The name of the flow log group.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| max_aggregation_interval    | core | int64      | The maximum interval of time, in seconds, during which a flow of packets is captured and aggregated into a flow log record. When a network interface is attached to a <a href="https://docs.aws.amazon.com/ec2/latest/instancetypes/ec2-nitro-instances.html">Nitro-based instance</a>, the aggregation interval is always 60 seconds (1 minute) or less, regardless of the specified value. Valid Values: <code>60</code> | <code>600</code>                        |
| resource_id                 | core | string     | The ID of the resource being monitored.                                                                                                                                                                                                                                                                                                                                                                                                                              |
| tags                        | core | hstore_csv |
| traffic_type                | core | string     | The type of traffic captured for the flow log.                                                                                                                                                                                                                                                                                                                                                                                                                       |