A company hosts a web application that tuns on a group of Amazon EC2 instances that ate behind an Application Load Balancer (ALB) in a VPC. The company wants to analyze the network payloads lo…

VPC Flow Logs capture metadata about all IP traffic going to and from network interfaces in a VPC, providing crucial information like source/destination IPs, ports, protocols, and byte counts that are essential for analyzing network activity and patterns to reverse-engineer an attack. This granular flow data allows security teams to identify suspicious connections and traffic anomalies.

While Traffic Mirroring captures full network packet payloads, it is typically used for real-time deep packet inspection and intrusion detection, rather than historical analysis of network metadata across an entire VPC for general attack reverse-engineering.

AWS WAF provides web application firewall logs for HTTP/S requests at Layer 7, which are useful for web application attacks but do not capture general network payloads or lower-level network traffic details necessary for broader attack analysis.

ALB access logs provide information about requests routed through the Application Load Balancer at Layer 7 (HTTP/S), focusing on web traffic details, but they do not capture raw network payloads or detailed flow information for all network traffic within the VPC.