Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Cloud WAN Flow Logs cover traffic across core-network attachments; use VPC Flow Logs separately when you need traffic to or from VPC network interfaces.
- Creating a subscription requires core-network owner permissions, and CloudWatch Logs, Amazon S3, or Data Firehose needs destination-specific IAM setup.
- Delivery is delayed rather than real time. Interpret INCOMPLETEDATA, SKIPDATA, and best-effort metadata as data-quality limits.
1. Define the traffic you need to observe
Cloud WAN Flow Logs capture IP traffic entering and leaving a core network, including attachment-to-attachment paths. Records can include IP addresses, ports, protocol, traffic volume, packet-loss counters, and Cloud WAN metadata such as segments, Regions, service-insertion hops, and attachments. AWS says the data is collected outside the traffic path, so it does not affect network throughput or latency.
The feature covers core-network traffic only. If you need traffic to and from a VPC network interface, assess VPC Flow Logs separately. The two products cover different scopes; Cloud WAN Flow Logs do not replace interface-level VPC logs. State the path and troubleshooting question first, then decide whether both views are needed.
2. Check the owner and the two permission boundaries
The person creating a subscription must own the core network and have networkmanager:GetCoreNetwork permission for the resource being subscribed to. IAM users do not have full Flow Logs access by default; also check the permissions needed to create, describe, and delete flow logs. Permission to read a core network alone does not establish that every Flow Logs operation is allowed.
The destination has its own permission boundary. For CloudWatch Logs, Amazon S3, or Amazon Data Firehose, check the required role, resource policy, and write access for that destination. Core-network permissions answer who may subscribe; destination IAM determines whether records can be written. Have the network and logging owners verify these separately.
3. Choose a supported resource and destination
The documented resource scopes include an entire core network, one core-network edge, or an attachment. Destinations include CloudWatch Logs, Amazon S3, and Amazon Data Firehose. Create subscriptions only in the Cloud WAN home Region. Plan for the limit of 250 subscriptions per resource per account; once a resource reaches the limit, remove subscriptions that are no longer needed before adding more.
Tunnel-less Connect (TLC) and Route Table attachments do not support direct subscriptions. Traffic traversing TLC appears on the underlying transport VPC attachment; traffic traversing a Route Table attachment appears on the underlying peering connection. If you need visibility into those paths, identify the resource that actually carries the traffic and choose the subscription scope from there.
4. Allow for activation and delivery time
Cloud WAN Flow Logs are not a real-time stream. Collection and delivery can take several minutes after creation. When the first subscription is created for a Cloud WAN resource, the core network enters UPDATING while resources are provisioned, and the subscription is PROVISIONING. After the core network returns to AVAILABLE, the subscription may still need several minutes to reach ACTIVE before records appear. Even after the subscription reaches ACTIVE, fully enabling log delivery for the resource can take a few more minutes.
During troubleshooting, note the core-network state, subscription state, creation time, and whether new events have reached the destination. Give provisioning time to finish, then verify the home Region, destination write permissions, and the target log group, bucket, or Firehose stream. A page loading successfully does not prove that the subscription is ACTIVE or that its destination has received data.
5. Read record status and metadata limits correctly
Flow Logs write records at attachments where traffic enters or leaves the core network. An internal error or log-propagation delay can prevent end-to-end correlation. INCOMPLETEDATA means the flow was not fully captured during an aggregation interval, so the record may contain only part of the data. SKIPDATA means some records were skipped, possibly because of an internal capacity constraint or error. Neither value alone proves that an application flow was interrupted.
A field may show a dash when it is not applicable or could not be computed. Cloud WAN metadata that does not come directly from packet headers is a best-effort approximation and may be missing or inaccurate. Keep these limits in mind during audits and capacity analysis: metadata is not exact proof of topology, and one missing field does not by itself establish a network failure.
6. Budget for the destination before setting retention
AWS says the Cloud WAN Flow Logs feature itself has no additional charge, but the selected destination is billed at its standard rates. The volume of records, destination ingestion and storage model, retention period, and later queries can affect your budget. Check the destination service’s current pricing for the applicable dimensions and rates. This guide gives no fixed price and does not equate a free Cloud WAN feature with zero log cost.
Before rollout, estimate destination costs from expected volume and retention, and confirm who will query the logs, the access policy, and the expiry rules. If traffic volume is not yet known, define the monitoring question and review period first, then validate the destination’s actual billing metrics. Avoid keeping every log indefinitely in a high-cost destination just to simplify setup.
Sources
Frequently Asked Questions
Does the default record format include 1:1 NAT addresses?
No. The default format excludes src-nat-addr and dst-nat-addr. To include them, select a custom format and name those fields explicitly. The default format itself cannot be changed.
Does NODATA mean collection failed?
AWS defines NODATA as no traffic to or from the core network during the aggregation interval. It differs from skipped or incomplete records; NODATA alone does not establish a collection fault.
Will deleting a subscription remove logs already stored?
It does not delete existing CloudWatch Logs streams or Amazon S3 log objects; manage those saved records separately. Collection can also take several minutes to stop after deletion, so deleting a subscription is not an immediate purge of historical data.