The new DDoS attack flow logs provide comprehensive traffic details including source/destination IPs, ports, protocols, packet and byte counts, and geolocation information. These logs are generated in 5-minute intervals during active DDoS events and published to Amazon S3, CloudWatch Logs, or Data Firehose for customer retrieval.
This visibility enables deeper post-attack investigation, threat intelligence generation, and compliance reporting. To utilize flow logs, customers must protect resources with Shield Advanced and configure log delivery destinations. The feature is broadly available wherever AWS Shield Advanced operates, enhancing defense and analysis capabilities.
Source & further reading
AWS Shield Advanced introduces DDoS attack flow logs ↗Source published 2026-05-29. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.