# FlowLogOptions

Options to add a flow log to a VPC.

- Source: [`aws-ec2/lib/vpc-flow-logs.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-ec2/lib/vpc-flow-logs.ts#L777)
- Type last changed: v2.123.0 · 24 Jan 2024

## Example

```ts
const vpc = new ec2.Vpc(this, 'Vpc');

vpc.addFlowLog('FlowLogS3', {
  destination: ec2.FlowLogDestination.toS3()
});

// Only reject traffic and interval every minute.
vpc.addFlowLog('FlowLogCloudWatch', {
  trafficType: ec2.FlowLogTrafficType.REJECT,
  maxAggregationInterval: ec2.FlowLogMaxAggregationInterval.ONE_MINUTE,
});
```

## Properties

- `destination`: [FlowLogDestination](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.FlowLogDestination.html) — Specifies the type of destination to which the flow log data is to be published.

  **Default:** FlowLogDestinationType.toCloudWatchLogs()

  Flow log data can be published to CloudWatch Logs or Amazon S3

- `logFormat`: [LogFormat](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.LogFormat.html)[] — The fields to include in the flow log record, in the order in which they should appear.

  **Default:** default log format is used.

  If multiple fields are specified, they will be separated by spaces. For full control over the literal log format
  string, pass a single field constructed with `LogFormat.custom()`.

  See https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-log-records

- `maxAggregationInterval`: [FlowLogMaxAggregationInterval](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.FlowLogMaxAggregationInterval.html) — The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record.

  **Default:** FlowLogMaxAggregationInterval.ONE_MINUTES if creating flow logs for Transit Gateway, otherwise FlowLogMaxAggregationInterval.TEN_MINUTES.

  When creating flow logs for a Transit Gateway or Transit Gateway Attachment,
  this property must be ONE_MINUTES.

- `trafficType`: [FlowLogTrafficType](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.FlowLogTrafficType.html) = ALL — The type of traffic to log.

  You can log traffic that the resource accepts or rejects, or all traffic.
  When the target is either `TransitGateway` or `TransitGatewayAttachment`, setting the traffic type is not possible.