---
type: resource-type
title: FlowLog
description: aws resource type AWS::EC2::FlowLog
name: FlowLog
lexicon: aws
resource_type: AWS::EC2::FlowLog
---
`AWS::EC2::FlowLog`, a resource type of the aws lexicon.

## Properties

- `ResourceId` (`string`, required): The ID of the subnet, network interface, or VPC for which you want to create a flow log.
- `ResourceType` (`"NetworkInterface" | "RegionalNatGateway" | "Subnet" | "TransitGateway" | "TransitGatewayAttachment" | "VPC"`, required): The type of resource for which to create the flow log. For example, if you specified a VPC ID for the ResourceId property, specify VPC for this property.
- `DeliverCrossAccountRole` (`string`, optional): The ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts.
- `DeliverLogsPermissionArn` (`string`, optional): The ARN for the IAM role that permits Amazon EC2 to publish flow logs to a CloudWatch Logs log group in your account. If you specify LogDestinationType as s3 or kinesis-data-firehose, do not specify DeliverLogsPermissionArn or LogGroupName.
- `DestinationOptions` (`Record<string, unknown>`, optional)
- `Id` (`string`, optional): The Flow Log ID
- `LogDestination` (`string`, optional): Specifies the destination to which the flow log data is to be published. Flow log data can be published to a CloudWatch Logs log group, an Amazon S3 bucket, or a Kinesis Firehose stream. The value specified for this parameter depends on the value specified for LogDestinationType.
- `LogDestinationType` (`"cloud-watch-logs" | "kinesis-data-firehose" | "s3"`, optional): Specifies the type of destination to which the flow log data is to be published. Flow log data can be published to CloudWatch Logs or Amazon S3.
- `LogFormat` (`string`, optional): The fields to include in the flow log record, in the order in which they should appear.
- `LogGroupName` (`string`, optional): The name of a new or existing CloudWatch Logs log group where Amazon EC2 publishes your flow logs. If you specify LogDestinationType as s3 or kinesis-data-firehose, do not specify DeliverLogsPermissionArn or LogGroupName.
- `MaxAggregationInterval` (`number`, optional): The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. You can specify 60 seconds (1 minute) or 600 seconds (10 minutes).
- `TagFieldSpecifications` (`FlowLog_TagFieldSpecification[]`, optional): The resource types and associated tags for EC2 resources associated with the EC2 Tags feature for log enrichment.
- `Tags` (`FlowLog_Tag[]`, optional): The tags to apply to the flow logs.
- `TrafficType` (`"ACCEPT" | "ALL" | "REJECT"`, optional): The type of traffic to log. You can log traffic that the resource accepts or rejects, or all traffic.

## Attributes

- `Id`