Mastering Network Traffic Monitoring on AWS

Network traffic monitoring is a cornerstone of the AWS Certified Solutions Architect - Professional curriculum. It involves the systematic collection, analysis, and response to data flowing across virtual private clouds (VPCs), hybrid connections, and AWS services to ensure security, reliability, and performance.

Learning Objectives

After studying this guide, you should be able to:

Identify and implement the four phases of monitoring on AWS.
Distinguish between VPC Flow Logs and AWS CloudTrail for traffic analysis.
Architect centralized traffic inspection using Transit Gateway (TGW) and Network Firewall (NFW).
Monitor and optimize EBS I/O and network throughput for high-performance workloads.
Apply latency-based routing and acceleration techniques to improve user experience.

Key Terms & Glossary

VPC Flow Logs: A feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC.
Transit Gateway (TGW): A network transit hub that connects VPCs and on-premises networks.
North-South Traffic: Traffic moving between the internal network (VPC) and the external world (Internet or On-Premises).
East-West Traffic: Traffic moving between different segments within the internal network (e.g., VPC-to-VPC).
Nitro System: The underlying platform for modern EC2 instances that provides enhanced networking (ENA) and security.

The "Big Idea"

In a modern cloud environment, visibility is the prerequisite for control. Without comprehensive monitoring across all layers (frontend to database), a system cannot achieve "Zero Trust" security or high reliability. Monitoring isn't just about looking at logs; it's a lifecycle of generating metrics, aggregating them for context, reacting in real-time to anomalies, and storing data for long-term forensic analysis.

Formula / Concept Box

Metric / Rule	Application	Logic / Threshold
EBS I/O Balance	`EBSIOBalance%`	If consistently low (< 20%), increase instance size to avoid throttling.
EBS Byte Balance	`EBSByteBalance%`	If consistently 100%, consider downsizing the instance (cost optimization).
Throughput Calculation	Max Bandwidth	Modern Nitro instances (e.g., M5n) can reach up to 100 Gbps.

Hierarchical Outline

The Four Phases of Monitoring
- Generation: Monitoring all components (EC2, ECS, RDS) using CloudWatch.
- Aggregation: Defining metrics and calculating meaningful values.
- Real-time Processing: Alarming and automated responses.
- Storage & Analytics: Long-term log retention and deep-dive analysis.
Network Visibility Tools
- VPC Flow Logs: Capturing L3/L4 traffic data.
- CloudTrail: Tracking API calls (management plane) vs. data plane traffic.
- CloudWatch Metrics: Performance counters (CPU, RAM, Network I/O).
Centralized Inspection Architectures
- Transit Gateway (TGW): Central hub for inter-VPC and hybrid connectivity.
- Network Firewall (NFW): Inline inspection for malicious traffic patterns.
Performance Optimization
- Enhanced Networking: Using ENA for higher PPS (packets per second).
- EFA (Elastic Fabric Adapter): Specialized for HPC and low-latency inter-node communication.

Visual Anchors

The Monitoring Lifecycle

Loading Diagram...

Centralized Inspection Architecture

\begin{tikzpicture}[node distance=2cm, every node/.style={rectangle, draw, rounded corners, minimum width=2.5cm, minimum height=1cm, align=center}] \node (tgw) [fill=orange!20] {\textbf{Transit Gateway}\ (Central Hub)}; \node (vpcA) [above left of=tgw, xshift=-1cm] {VPC A\ (App Layer)}; \node (vpcB) [above right of=tgw, xshift=1cm] {VPC B\ (DB Layer)}; \node (nfw) [below of=tgw] {\textbf{AWS Network Firewall}\ (Inspection)}; \node (internet) [below of=nfw] {Internet / On-Prem};

code

\draw[<->, thick] (vpcA) -- (tgw);
\draw[<->, thick] (vpcB) -- (tgw);
\draw[<->, thick] (tgw) -- (nfw) node[midway, right] {\tiny Forced Routing};
\draw[<->, thick] (nfw) -- (internet);

\node[draw=none, fill=none, font=\itshape] at (-4, 1) {East-West Traffic};
\node[draw=none, fill=none, font=\itshape] at (3, -2) {North-South Traffic};

\end{tikzpicture}

Definition-Example Pairs

Metric Extraction: The process of creating numerical metrics from text-based logs.
- Example: Creating a CloudWatch Metric Filter to count the occurrences of "404 Not Found" in web server logs to trigger an alarm.
Latency-Based Routing: Routing end users to the AWS Region that provides the lowest network latency.
- Example: A user in London is automatically routed to eu-west-2 instead of us-east-1 because Route 53 detects a shorter round-trip time.
EFA (Elastic Fabric Adapter): A network interface for EC2 instances that provides OS-bypass capabilities.
- Example: A Weather Forecasting cluster using hundreds of nodes that requires sub-millisecond communication for fluid dynamics simulations.

Worked Examples

Scenario: Troubleshooting "Throttled" Database Performance

Problem: A Solutions Architect notices an RDS instance is underperforming, even though CPU usage is low (~30%).

Step-by-Step Breakdown:

Check CloudWatch Metrics: Look for EBSIOBalance%. If this is low, the instance has exhausted its I/O credits or is hitting the throughput limit of the instance type.
Identify the Bottleneck: Check if the instance is "EBS-Optimized." Since 4th-gen instances, this is default, but older instances might need it enabled.
Resolution:
- If EBSIOBalance% is low: Increase instance size (e.g., from M5.large to M5.xlarge) to provide more dedicated throughput for EBS.
- If NetworkIn / NetworkOut is at the limit: Upgrade to an "n" series instance (e.g., M5n) which supports up to 100 Gbps.

Checkpoint Questions

What are the four phases of monitoring identified in the AWS reliability framework?
Which specific AWS log type should you enable to analyze traffic patterns between two VPCs connected via peering?
How does Route 53 determine which endpoint to send a user to when using Latency-Based Routing?
What is the primary difference between North-South and East-West traffic in a TGW architecture?

Muddy Points & Cross-Refs

CloudTrail vs. VPC Flow Logs: Beginners often confuse these. CloudTrail records who called the API (e.g., "User Bob created a bucket"). VPC Flow Logs record what data moved (e.g., "IP 10.0.0.1 sent 500 bytes to 8.8.8.8").
TGW Routing: Remember that routing tables exist both at the VPC level (subnet route tables) and the TGW level. To inspect traffic, the VPC route table must point to the TGW, and the TGW route table must point to the firewall endpoint.

Comparison Tables

AWS Monitoring Tools Comparison

Feature	CloudWatch Metrics	VPC Flow Logs	AWS CloudTrail
Data Type	Numerical (Time-series)	Network Flow (IP/Port)	API Call History
Use Case	Performance Alarms	Security Analysis/Forensics	Compliance/Audit
Resolution	1-minute (Standard)	~1 to 10-minute aggregation	Near real-time
Focus	Resource Health	Network Connectivity	Identity & Actions

Enhanced Networking Options

Feature	ENA (Elastic Network Adapter)	EFA (Elastic Fabric Adapter)
Standard Speed	Up to 100 Gbps	Up to 100 Gbps
Use Case	General purpose networking	HPC / Machine Learning
Latency	Low	Ultra-low (OS Bypass)
Compatibility	Most current-gen instances	Select instance types (e.g., Hpc6a, P4d)