I got a chance to attend AWS Community Day Kochi on 20 December 2025. What an amazing event! Brilliant minds, deep-dive technical courses and a strong cloud community. There were many of great seminars on everything from modern serverless architectures to more sophisticated DevOps approaches, but one session in particular stole the show for me.
The session was delivered by Yeshwanth L M on AWS Bedrock VPC Flow Log Analyser. This presentation was a breath of fresh air after far too many late nights staring at endless rows of black and white network logs. I made sure to snap some good pictures of the slides so I could deconstruct this great tool for you all.
The Network Log Nightmare
Let’s face it… sifting through raw network logs is a horrible, mind-numbing process.
Think of a Virtual Private Cloud (VPC) as a big, high-security office building. Each time a piece of data comes in, goes out of or moves across rooms, a digital security guard makes a line in a ledger. In the AWS ecosystem this ledger is called VPC Flow Logs. They record complete, rich IP traffic data across all your network interfaces, offering complete visibility into your network environment.
Does this sound familiar? If you’ve ever turned them on, you know what the catch is. The raw logs are quite verbose and complex immediately creating huge volumes of data.
To give you a feel for what this looks like in the wild, here’s an exact slice of the event data shown throughout the session. If you check your logs now, you will likely find a wall of text similar to this:
2 493062987015 eni-30076669 107.170.242.27 172.31.8.238 123 123 17 1 76 1433806982 1433807038 ACCEPT OK
2 493062987015 eni-30076669 172.31.8.238 107.170.242.27 123 123 17 1 76 1433806982 1433807038 ACCEPT OK
2 493062987015 eni-30076669 79.33.7.53 172.31.8.238 54517 23 6 3 180 1433807174 1433807218 REJECT OK
2 493062987015 eni-30076669 71.6.135.131 172.31.8.238 15314 21379 6 1 40 1433807224 1433807278 REJECT OK
2 493062987015 eni-30076669 172.31.8.238 108.61.56.35 123 123 17 1 76 1433807281 1433807338 ACCEPT OK
To get any useful information out of this digital alphabet soup , you need a specialised analysis . You need to be a wizard with advanced analytical tools or know complex query languages to even find out if your application is safe.
The Analysis Bottleneck
The logs are so extensive that development teams are soon faced with what speaker called the “Analysis Bottleneck.” This bottleneck impacts engineering teams in 4 big ways:
Time-Consuming Process: “Manual analysis is a big bottleneck, where it takes hours to dig through data that should be instantly available.”
Error-Prone Review: The immense amount and complexity of raw text may result in manual reviews subject to human error and oversight.
Skill & Accessibility Barrier: If a team member lacks in-depth technical knowledge of specific log querying systems, they are unable to access data.
Operational Inefficiency: These variables delay down incident response and hide crucial network security discoveries.
Why VPC Flow Logs Matter
You might be wondering...if they are such a headache to read, why don't we just avoid them?
But here's the thing... you can't turn them off if you care about your cloud infrastructure. They are of extreme importance for three main reasons:
Security Configuration: They’re critical for detecting security group and Network ACL misconfigurations that could expose your system to attacks.
Traffic Monitoring: They are essential for monitoring traffic patterns and detecting anomalies indicating potential security events or performance difficulties.
Troubleshooting: They are critical for diagnosing connectivity difficulties and improving your network security posture with data-driven insights.
Introducing the Bedrock-Powered Solution
In addition this is when it gets fascinating... What if you could chat with your network logs the same way you interact with a teammate on Slack?
That’s exactly what the Amazon Bedrock-Powered VPC Flow Log Analyser accomplishes. It entirely bypasses the typical log analysis headache via 3 fundamental pillars:
Gen AI Integration: It uses the latest generative AI from Amazon Bedrock to understand natural language questions with unmatched accuracy.
Plain English Queries: No complex query writing is required. You simply ask enquiries in simple English, like you would to a coworker.
Intelligent Translation: It automatically transforms your questions into accurate database queries to obtain useful insights from your flow logs.
Architectural Shifts: Traditional vs. Modern
To understand why this is a game changer, we need to understand the architecture progression. Think of your database as a huge library. If you want to know a specific information, the old technique is to study the Dewey Decimal System, locate the book, read the complete chapter.
In a Traditional Architecture, your VPC generates flow logs and pushes them to an Amazon S3 bucket. From there you need to configure Amazon Athena to analyse the logs, run custom SQL queries and tie it up to a visualisation dashboard. It works but needs effort, maintenance and a particular skill set to manage the queries.
Next, let’s look at the AWS Bedrock VPC Flow Log Analyser Architecture. The set-up is simply amazing. The VPC continues to push logs to S3 and CloudWatch. But instead of an engineer writing SQL queries by hand, the logs go straight into Amazon Bedrock. You just type into the system: “Is there any unusual activity from an unknown person?”
How the Data Processing Magic Works
So how can a raw string of text turn into an intelligent conversation? The tool orchestrates a smooth five-step Data Processing Flow:
Flow Log Retrieval: It takes the raw VPC Flow Log data directly from CloudWatch Logs.
Data Formatting: It converts those messy flow logs into a structured, highly readable format (e.g.,
10.0.1.100:443 -> 10.0.2.200:80 (TCP) [ACCEPT] 1500B/10P).Context Creation: It then produces a rather complete system prompt that includes summary statistics (total records, unique IPs, bytes, packets), the detailed records from the flow log, and explicit directions for analysing the data.
Bedrock Query: It summarises the prepared data and the user query, and sends it directly to the Claude 3 Sonnet model in Amazon Bedrock.
Response Processing: It takes the model’s output and sends the AI-generated analysis back to you.
Smart Token Management
Long story short… there are limits to how much text Large Language Models can process at once. Speaker also built a smart token optimisation layer to maintain the tool’s speed and efficiency:
Query Limits: It limits data to 150 flow log records maximum every query to prevent hitting token restrictions at any costs.
Max Tokens: It limits responses to 2000 tokens so that responses will be short.
Optimization: It is a small format which minimises token costs but retains the detail intact.
Absolutely, the complete lack of persistent resources is what makes this tool so elegant. It invokes the model directly. That implies no creation of AI agents, no storage of data within Bedrock, no permanent knowledge bases to maintain, and every query is 100% stateless.
Getting Practical: Prerequisites and Usage
The Prerequisites to execute this in your own environment are really straightforward:
AWS CLI configured with the right permissions.
Python 3.10 or higher.
AWS Bedrock access in your region.
VPC Flow Logs enabled (really the tool will guide you if they are not enabled)
IAM Permissions for:
ec2:DescribeVpcs,ec2:DescribeFlowLogs,logs:FilterLogEvents, andbedrock:InvokeModel.
Once you clone the source and install the requirements, figuring out How to Use It is only four easy steps:
Run the Analyzer: Execute
python vpc_flow_analyzer.pyto start the tool.Verify Flow Logs: Enter your VPC ID; the program will check if VPC Flow Logs are enabled and provide you some instructions.
Select Time Range: Specify the hours of data to analyze (like 1 hour, 6 hours, 24 hours, or 1 week).
Ask Questions: Query your flow log data using natural language.
Real-World Questions You Can Ask
The session showcased some great examples of questions you can ask, grouped by what you’re looking to discover:
IP & Port Analysis
"What source IP addresses do you see?"
"List all destination IP addresses"
"What destination ports are being accessed?"
"Which IP has the most traffic?"
Protocol & Security Analysis
"Show me all TCP connections"
"Which protocols are being used?"
"Which connections were rejected?"
"Show me suspicious activities"
"Are there any failed connection attempts?"
Traffic Analysis
"What's the largest data transfer?"
"Show me connections to external IPs"
"Which interface has the most traffic?"
Direct Invocation vs. Bedrock Agents
The presentation had a wonderful architectural comparison. Why would you use direct model invocation rather than develop a full Bedrock Agent?
The breakdown makes the option straightforward. Direct Model Invoke doesn’t require any setup, however Bedrock Agents require you to create an agent and build up a knowledge base. With direct invocation, no data is persisted, therefore data is always up to date from the flow logs. Bedrock Agents, in contrast, store data in knowledge bases and require constant data syncing.
When all is said and done, direct invocation offers a straightforward, stateless experience pulling live data directly from CloudWatch without complex maintenance.
Cost Considerations
The bottom line? This slim design keeps the money in your pocket. It avoids costly infrastructure, therefore the cost concerns are highly developer-friendly:
Pay-per-use: You are only charged for actual model invocations.
Input Tokens: The cost is only a function of the size of the flow log data plus the system prompt.
Output Tokens: Charges are based on response length (safely capped at max 2000 tokens).
No Setup Costs: There is absolutely no infrastructure or agent setup required.
Key Takeaways
Here’s a quick rundown on why this technology is such a giant leap forward for cloud teams:
Plain English is the New Query Language: You don’t need to be a SQL guru, or create complex Athena queries, to comprehend your network traffic. Just ask enquiries in a genuine manner.
Lightweight and Stateless: The tool gets live data immediately without persistent storage or complex setup by calling the model directly instead of heavy Bedrock Agents.
Highly Cost-Effective: You pay only for what you use. There are no knowledge bases to store, no agents to operate, hence your token expenses are very inexpensive.
Democratizes Security: In the end, this solution opens up the critical network data to the team, removing the skills barrier to debugging.
Conclusion
AWS Community Day Kochi 2025 was a fantastic example of how important local tech communities are. Yeshwanth’s breakthrough ideas reveal how generative artificial intelligence may remove all the friction points in ordinary cloud operations.
If you are developing a startup or running cloud deployments on a small budget, binding Amazon Bedrock straight to your VPC Flow Logs is a fast, stateless and simple solution to keep your network safe. Long story short… it makes a terrible operational duty into a really entertaining conversation.
About the Author
As an AWS Community Builder, I enjoy sharing the things I've learned through my own experiences and events, and I like to help others on their path. If you found this helpful or have any questions, don't hesitate to get in touch! 🚀
🔗 Connect with me on LinkedIn
References
Event: AWS Community Day Kochi
Topic: AWS Bedrock VPC Flow Log Analyzer
Date: December 20, 2025
Top comments (0)