VPC Flow Logs cost: the free feature with a delivery bill

Quick answer

Enabling VPC Flow Logs costs nothing, but the logs have to go somewhere, and that delivery is where you pay. Sending flow logs to CloudWatch Logs incurs the standard ingestion charge of about $0.50 per GB plus storage at about $0.03 per GB per month. Sending them to S3 uses the cheaper vended-logs delivery rate (around $0.25 per GB for the first tier) plus low S3 storage. On a busy VPC, flow logs can generate substantial volume, so the delivery cost is real. The lesson: flow logs are free to turn on but not free to store, so send high-volume flow logs to S3 and sample or filter what you capture.

VPC Flow Logs capture metadata about the traffic in your VPC, invaluable for security analysis, troubleshooting, and understanding data flows. AWS does not charge for the flow logs feature itself, which leads teams to assume it is free. It is not: the logs must be delivered to a destination, and that delivery carries the same ingestion and storage charges as any other logs, which on a busy VPC can add up.

Where the cost comes from

Destination	Approximate cost
CloudWatch Logs	~$0.50/GB ingestion + ~$0.03/GB storage
S3 (vended logs)	~$0.25/GB delivery + low S3 storage
The flow logs feature	Free

Flow logs delivered to CloudWatch Logs pay the standard ingestion rate of about $0.50 per GB plus storage. Delivered to S3, they use the vended-logs delivery rate, roughly half the CloudWatch ingestion cost, plus S3 storage that is far cheaper than CloudWatch storage. So the same flow logs can cost roughly twice as much going to CloudWatch as to S3.

How much volume flow logs generate

A busy VPC generates a lot of flow log records, one per network flow per capture window, and that volume scales with traffic and the number of interfaces. A high-traffic production VPC can produce tens or hundreds of GB of flow logs a month. At $0.50 per GB to CloudWatch, 200 GB is about $100 a month just to ingest, plus storage, for logs that in many cases are only occasionally queried. Sent to S3 instead, the same volume costs roughly half to deliver and a fraction to store.

Reducing flow log cost

First, choose the destination deliberately: send high-volume flow logs to S3 rather than CloudWatch unless you need CloudWatch's real-time querying and alarms, since S3 delivery and storage are much cheaper. Second, control what you capture: use a custom log format to record only the fields you need, and consider capturing only rejected traffic or only specific subnets if that meets your needs, rather than all traffic on every interface. Third, adjust the aggregation interval; a longer maximum aggregation interval produces fewer, more aggregated records. These mirror the levers inCloudWatch Logs optimization.

Balancing visibility and cost

Flow logs are a security and observability asset, so the goal is not to disable them but to capture and store them cost-effectively. Full capture to CloudWatch on every VPC is the expensive default; targeted capture to S3 with the fields you actually use is the efficient version. Because the delivery cost scales with traffic volume, it is easy to under-estimate, one of thecharges that add up quietly on a busy environment.

Since the cost depends on log volume and destination, both of which you decide up front, estimate them before enabling. Price your logging and flow log configuration against theresource catalog so the delivery cost is understood before a busy VPC starts streaming logs.

FAQ

Are VPC Flow Logs free?

The flow logs feature itself is free to enable, but delivering the logs to a destination is not. Sending them to CloudWatch Logs costs about $0.50 per GB ingestion plus storage. Sending them to S3 uses the cheaper vended-logs delivery rate, around $0.25 per GB, plus low S3 storage. On a busy VPC generating hundreds of GB of flow logs, that delivery cost is real and often surprising.

Should I send VPC Flow Logs to CloudWatch or S3?

Send high-volume flow logs to S3 unless you need CloudWatch's real-time querying and alarms. S3 uses the vended-logs delivery rate at roughly half the CloudWatch ingestion cost, and S3 storage is far cheaper than CloudWatch storage. So the same flow logs can cost about twice as much going to CloudWatch. Use CloudWatch only when you need its live analysis features on the flow data.

How much do VPC Flow Logs cost on a busy VPC?

A high-traffic production VPC can generate tens or hundreds of GB of flow logs a month. At the CloudWatch ingestion rate of about $0.50 per GB, 200 GB is about $100 a month just to ingest, plus storage. Sent to S3 instead, the same 200 GB costs roughly half to deliver and a fraction to store, which is why destination choice matters for high-volume flow logs.

How do I reduce VPC Flow Logs cost?

Send high-volume logs to S3 rather than CloudWatch, use a custom log format to capture only the fields you need, consider capturing only rejected traffic or specific subnets rather than all traffic on every interface, and use a longer maximum aggregation interval to produce fewer, more aggregated records. These reduce both the volume delivered and the per-GB destination cost.

Can I capture only some VPC Flow Log data?

Yes. You can configure flow logs to capture only accepted, only rejected, or all traffic, apply them to specific subnets or interfaces rather than the whole VPC, and use a custom log format to record only the fields you need instead of the full default set. Capturing less data directly reduces the delivery and storage cost while keeping the visibility that matters for your use case.

How does C3X help with VPC Flow Logs cost?

C3X prices your flow log configuration from Terraform before you deploy, including the destination and its ingestion or delivery rate, so the delivery cost is visible in the pull request. That helps you choose S3 over CloudWatch for high-volume logs and scope what you capture at design time, rather than discovering the delivery bill after a busy VPC has been streaming full flow logs to CloudWatch.

What to do next

Price your flow log delivery before you enable it. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.