VPC Flow Logs CloudWatch to S3
Flow logs delivered to CloudWatch Logs are billed at log-ingestion rates; the same records delivered to S3 are billed as storage, which is materially cheaper for high-volume logs.
Free to start. No card. The playground just needs your work email.
AWS
Found, explained, handed over.
Findings with a dollar figure attached, idle, oversized, orphaned, unscheduled and undiscounted spend.
Detect
ZopNight checks this automatically across AWS, with read-only access to the account.
Explain
Every finding says exactly what to change: Send VPC flow logs to S3 instead of CloudWatch. Where the saving can be proven it is priced; where it cannot, the finding says so.
Fix
The finding opens with the fix already written out, step by step, so it is one ticket, not an investigation.
- Applies to
- VPC and Networking on AWS
- The fix, by hand
- Create an S3 bucket for flow logs with a lifecycle rule (e.g. transition to IA after 30 days, Glacier after 90).
- VPC → Flow logs → Create flow log. Destination S3, point at the new bucket, traffic type = ALL (match existing flow log scope).
- Wait 15 min, confirm objects are landing in S3 under AWSLogs/‹account›/vpcflowlogs/.
- Set up Athena tables over the S3 prefix (or use AWS Network Insights).
- Recreate any metric-filter alarms in their new form (CloudWatch Metrics → custom metrics published from Athena, or migrate to GuardDuty).
- Delete the old CloudWatch flow log after one full retention cycle.
These are the steps the finding carries in the product.
- Category
- Rightsizing. Resources sized for headroom they never use. A smaller size runs the same workload for less.
- Where it appears
- The Savings tab of Recommendations, with every affected resource listed.
- Rule ID
RC-055- Full reference
Related checks
See the oversized resources in your account.
Connect a read-only role and the first pass runs on your own estate. This check, and the rest of the catalogue, with it.
Prefer to talk it through first? Book 20 minutes with the team.
- $30M+annualised cloud spend under management
- 550K+resources tracked since launch
- 20-60%off the bill in the first month
- SOC 2Type II report, plus ISO 27001
Figures published on zop.dev.