A municipal security operations center needs flow-level visibility…

Question

A municipal security operations center needs flow-level visibility of east-west traffic across Transit Gateway attachments to investigate anomalous paths between department VPCs. Which monitoring approach best supports this investigation?

Accepted Answer

Enable Transit Gateway Flow Logs (and VPC Flow Logs where needed) and deliver the records to a centralized logging destination for analysis. — When east-west traffic goes weird, you need a flight recorder—not a spreadsheet of last month's spend. Transit Gateway and VPC Flow Logs show who talked to whom across attachments. Turning logging off to save pennies makes investigations guesswork.

Answer

Disable all flow logging to reduce cost and rely only on monthly architecture review meetings.

Answer

Inspect traffic solely with public internet packet captures outside AWS because TGW flows cannot be logged.

Answer

Use only Cost Explorer daily granularity reports as a substitute for network flow telemetry.

A municipal security operations center needs flow-level visibility of east-west traffic across Transit Gateway attachments to investigate anomalous paths between department VPCs. Which monitoring approach best supports this investigation?

Short Explanation

Full Explanation