Documentation
¶
Overview ¶
Package awsvpc implements providers.NetworkProvider against AWS VPC Flow Logs delivered to a CloudWatch Logs group, surfacing REJECT (denied) flows for an investigation. All calls are read-only (FilterLogEvents).
It is CNI-agnostic: it works on any AWS VPC — including EKS clusters running the AWS VPC CNI — unlike Cilium Hubble, which requires the Cilium data plane. Auth uses the SDK's default credential chain (EKS Pod Identity / IRSA / env / profile), the same mechanism as internal/providers/cloud/aws.
VPC Flow Logs are IP-based: a flow record carries source/destination IPs, not Kubernetes namespaces or pod names. This v1 therefore does NOT resolve the Selector's namespace/pod down to IPs — Drops ignores the Selector and returns recent VPC-wide REJECTs. Mapping IPs back to workloads is left for a later pass.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client queries a CloudWatch Logs group that receives AWS VPC Flow Logs.
func New ¶
New builds a Client from the default AWS credential chain (Pod Identity / IRSA / env / profile). region may be empty (resolved from the environment/IMDS). logGroup is the CloudWatch Logs group VPC Flow Logs are delivered to and must be non-empty.
func (*Client) Drops ¶
func (c *Client) Drops(ctx context.Context, _ providers.Selector, w providers.TimeWindow) (providers.LogResult, error)
Drops returns recent VPC-wide REJECT flows within the window.
sel is IGNORED: VPC Flow Logs are IP-based and this v1 does not map the selector's namespace/pod to IPs, so Drops cannot scope to a workload (see the package doc). It calls FilterLogEvents with the REJECT filter pattern, following NextToken pages until maxEvents events are collected or pagination is exhausted, parsing each space-delimited flow-log v2 message into a normalized LogLine.
Source Files