Task Statement 2.2: Implement routing and connectivity across multiple AWS accounts, Regions, and VPCs to support different connectivity patterns.

📘AWS Certified Advanced Networking – Specialty

1. Why Network Monitoring and Logging Matter

In AWS networking, monitoring and logging help you:

Detect network issues (latency, packet loss, misrouting)
Identify security threats (unauthorized access, suspicious traffic)
Troubleshoot connectivity problems
Ensure compliance and auditing

For the exam, always remember:

👉 Monitoring = Real-time visibility
👉 Logging = Historical records for analysis

2. Key AWS Services for Network Monitoring & Logging

You must know these core services very well:

2.1 Amazon CloudWatch

Purpose:

Central monitoring service for metrics, logs, and alarms.

Key Features:

Collects metrics (CPU, network traffic, packets)
Stores logs
Creates alarms
Provides dashboards

Networking Use Cases:

Monitor VPC traffic throughput
Detect high latency or packet drops
Track VPN tunnel status
Monitor load balancer traffic

Important Components:

Metrics → Numerical data (e.g., bytes in/out)
Logs → Text records
Alarms → Trigger actions when thresholds are exceeded

Exam Tip:

👉 CloudWatch is the central hub for monitoring in AWS.

2.2 Amazon VPC Flow Logs

Purpose:

Captures IP traffic metadata going to and from network interfaces.

What It Records:

Source IP
Destination IP
Port numbers
Protocol (TCP/UDP)
Traffic status (ACCEPT/REJECT)

Where You Can Enable It:

VPC level
Subnet level
Elastic Network Interface (ENI)

Storage Options:

CloudWatch Logs
S3

Use Cases:

Troubleshooting connectivity
Security analysis
Detecting unauthorized traffic

Example (IT scenario):

If an EC2 instance cannot reach a database:

Check Flow Logs to see if traffic is rejected by NACLs or security groups

Limitations:

Does NOT capture:
- Packet payload
- DNS queries (use Route 53 logging instead)

Exam Tip:

👉 Flow Logs show metadata, not full packet data

2.3 AWS CloudTrail

Purpose:

Tracks API calls and account activity

What It Logs:

Who made the request
What action was performed
When it happened
Source IP

Networking Use Cases:

Track changes to:
- Route tables
- Security groups
- Network ACLs
Detect unauthorized configuration changes

Storage:

S3 (default)
Can integrate with CloudWatch

Example:

If routing suddenly stops working:

Check CloudTrail to see if someone modified a route table

Exam Tip:

👉 CloudTrail = “Who changed what in the network?”

2.4 AWS Transit Gateway Flow Logs

Purpose:

Monitor traffic through Transit Gateway.

Key Benefits:

Visibility into inter-VPC and hybrid traffic
Helps troubleshoot multi-account architectures

Use Cases:

Identify routing issues between VPCs
Monitor traffic between on-premises and AWS

Exam Tip:

👉 Required for large-scale multi-VPC monitoring

2.5 Elastic Load Balancing Access Logs

Types:

Application Load Balancer (ALB)
Network Load Balancer (NLB)

What They Log:

Client IP
Request path
Response codes
Latency

Storage:

Use Cases:

Analyze application traffic
Detect unusual patterns (e.g., spikes)

2.6 Amazon Route 53 Logging

Logging Types:

Query logging
Resolver query logging

What It Shows:

DNS queries made in your environment

Use Cases:

Detect DNS-based attacks
Troubleshoot name resolution issues

2.7 AWS Config

Purpose:

Tracks configuration changes over time.

Networking Use Cases:

Monitor:
- Security groups
- Route tables
- VPC configurations

Key Feature:

Compliance rules

Example:

Check if:

A security group suddenly allows 0.0.0.0/0

2.8 AWS GuardDuty

Purpose:

Intelligent threat detection.

Data Sources:

VPC Flow Logs
CloudTrail
DNS logs

Detects:

Suspicious IP communication
Port scanning
Unauthorized access attempts

Exam Tip:

👉 GuardDuty = automated security analysis

2.9 AWS Network Firewall Logs

Purpose:

Provides deep packet inspection logging

Log Types:

Alert logs
Flow logs

Use Cases:

Monitor firewall rule matches
Detect blocked traffic

3. Monitoring Hybrid and Multi-Region Networks

In advanced networking scenarios, monitoring becomes more complex.

Key Areas to Monitor:

1. VPN Connections

Tunnel status (UP/DOWN)
Throughput
Errors

👉 Use CloudWatch metrics

2. Direct Connect

Connection state
Bandwidth utilization

3. Inter-Region Traffic

Latency
Packet drops

👉 Use:

CloudWatch
VPC Flow Logs

4. Multi-Account Monitoring

Use:

Centralized logging account
Cross-account CloudWatch dashboards

4. Centralized Logging Architecture

For the exam, this is VERY important.

Best Practice Design:

Send logs from:
- VPC Flow Logs
- CloudTrail
- ELB logs
Store in:
- Central S3 bucket
Analyze using:
- CloudWatch Logs Insights
- Athena

Benefits:

Easier auditing
Better security visibility
Simplified troubleshooting

5. Log Analysis Tools

Amazon CloudWatch Logs Insights

Query logs using SQL-like syntax
Find patterns quickly

Amazon Athena

Query logs stored in S3
Useful for large-scale analysis

Amazon OpenSearch Service

Real-time log analytics
Visualization dashboards

6. Key Monitoring Metrics (Important for Exam)

Network Metrics to Watch:

BytesIn / BytesOut
PacketsIn / PacketsOut
Error rates
Latency
Connection count

Load Balancer Metrics:

Request count
Target response time
HTTP error codes

7. Security Monitoring Strategy

Combine Multiple Services:

Flow Logs → Traffic visibility
CloudTrail → API activity
GuardDuty → Threat detection
Config → Compliance

👉 Together they provide complete security monitoring

8. Common Exam Scenarios

Scenario 1:

Cannot connect to EC2

Check:

VPC Flow Logs → traffic allowed/denied
Security Groups / NACLs
Route tables

Scenario 2:

Unexpected network behavior

Check:

CloudTrail → recent changes

Scenario 3:

Suspicious traffic

Use:

GuardDuty findings
Flow Logs analysis

Scenario 4:

Multi-VPC communication failure

Check:

Transit Gateway Flow Logs
Route propagation

9. Best Practices (Highly Important)

1. Enable Logging Everywhere

VPC Flow Logs
CloudTrail (all regions)

2. Use Centralized Logging

Store logs in a single S3 bucket

3. Set CloudWatch Alarms

Detect anomalies automatically

4. Use Least Privilege Access

Restrict who can view logs

5. Retain Logs Properly

Use lifecycle policies in S3

6. Encrypt Logs

Use KMS encryption

10. Quick Revision Summary (Exam Focus)

Core Services:

CloudWatch → Monitoring
VPC Flow Logs → Traffic metadata
CloudTrail → API tracking
GuardDuty → Threat detection
Config → Configuration tracking

Key Concepts:

Monitoring = real-time
Logging = historical
Centralized logging = best practice

Must Remember:

Flow Logs ≠ packet data
CloudTrail tracks changes
GuardDuty analyzes threats automatically