VPC Flow Logs Not Working — 4 Causes and How to Fix Each

You enabled VPC Flow Logs, but nothing is appearing in CloudWatch or S3. The flow log shows as active in the console, yet the log group is empty. Before you recreate anything, run one command to check the actual delivery status.

Step 1: Check the Delivery Status

aws ec2 describe-flow-logs \
  --query 'FlowLogs[*].[FlowLogId,FlowLogStatus,DeliverLogsStatus,DeliverLogsErrorMessage]' \
  --output table

The DeliverLogsStatus field is either SUCCESS or FAILED. If it's FAILED, DeliverLogsErrorMessage tells you exactly what went wrong. The four most common causes follow.

Cause 1: IAM Role Permissions Missing

This is the most frequent cause. The IAM role used by the flow log needs specific permissions to write to CloudWatch Logs.

Required IAM policy for the role:

And the trust policy must allow the VPC Flow Logs service to assume the role:

Check what trust the current role has:

aws iam get-role \
  --role-name your-flow-log-role \
  --query 'Role.AssumeRolePolicyDocument'

Cause 2: CloudWatch Log Group Doesn't Exist

When you specify a log group name that doesn't exist yet, the flow log shows as active but delivery fails silently — or shows a LogDestinationNotFoundException.

# Check if the log group exists
aws logs describe-log-groups \
  --log-group-name-prefix /vpc/flow-logs

# Create it if missing
aws logs create-log-group \
  --log-group-name /vpc/flow-logs

Cause 3: Normal Delivery Delay

Flow logs are not real-time. If you just enabled them and generated some traffic, the logs may simply not have arrived yet.

• CloudWatch Logs: 10–15 minute delay after traffic occurs
• S3: Logs appear in 5-minute batches, but may take up to 60 minutes to be visible in S3

Wait 20 minutes after generating test traffic before concluding something is broken. Generate traffic with a simple curl from the instance:

# Generate traffic to trigger flow log entries
curl -s https://checkip.amazonaws.com
ping -c 3 8.8.8.8

Cause 4: Wrong Region

Flow logs are regional. If your VPC is in us-west-2 but you're looking at CloudWatch Logs in us-east-1, you'll see nothing. The log group must exist in the same region as the VPC.

# Confirm the region of your VPC
aws ec2 describe-vpcs \
  --vpc-ids vpc-0abc123 \
  --query 'Vpcs[*].[VpcId,OwnerId]'

# Look in the correct region
aws logs describe-log-groups \
  --region us-west-2 \
  --log-group-name-prefix /vpc/

Recreating the Flow Log (If Needed)

If the flow log is in a permanent FAILED state, delete and recreate it after fixing the underlying cause:

# Delete the broken flow log
aws ec2 delete-flow-logs --flow-log-ids fl-0abc123

# Recreate targeting the VPC
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-0abc123 \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /vpc/flow-logs \
  --deliver-logs-permission-arn arn:aws:iam::123456789:role/flow-log-role

What Flow Logs Are Used For

Once working, VPC Flow Logs let you query network traffic with Athena — finding S3 traffic routing through NAT Gateway, identifying cross-AZ data transfer, or detecting unexpected internet egress. See our VPC Flow Logs query guide for 4 copy-paste Athena queries.