Exam AWS Certified Security - Specialty topic 1 question 203 discussion

B. D. New flow logs + custom attributes

B and D ( pkt-srcaddr field displays the IP address of the host on the internet.)

Cannot change fields in an existing VPC Flow Log. WIll need create a new VPC Flow log with custom format/fields, that include pkt-srcaddr & pkt-dstaddr for this case.

We must create a new VPC flow log with the required fields. Source and destination addresses can be defined using pkt-srcaddr/pkt-dstaddr. BD

B VPC flow log cannot be modified except the tags. package-level source/destination IP address field is needed to get distinguish the intermidiate layer, such as NAT gateway, IPs.

B & D (new flow log + Custom Attributes) You can't edit a VPC flow log.

B & D are correct. B - "After you create a flow log, you cannot change its configuration or the flow log record format. For example, you can't associate a different IAM role with the flow log, or add or remove fields in the flow log record. Instead, you can delete the flow log and create a new one with the required configuration." Reference: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-logs-limitations D - https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-nat

not sure about D. any other comments friends ?

B and D. Existing flow logs cannot have their configuration (flow log format) denied.

B and D are ok. PD: You can't just go and edit an existing vpc flow log...