Delivery configuration and IAM authorization must both allow log-stream creation and event publication; this belongs to authorized publication of VPC flow telemetry, while the problem is automated verification of load-balancer logging posture.

Network flow summaries do not include HTTP payload and URI content, so a different telemetry layer is required; this changes selecting the right logging layer for HTTP investigation, not the necessary automated verification of load-balancer logging posture.

In the web request forensic evidence beyond network metadata workflow, ALB access logging contains structured HTTP request details, while complete custom header capture may require application-level instrumentation; the current case needs automated verification of load-balancer logging posture.

Centralized log custody and controlled permissions reduce risk that workload operators can erase records of network activity; that addresses tamper-resistant multi-account network flow retention, rather than centralized administrative event collection across accounts.

WAF request logs show rule evaluation and final actions, providing decision evidence beyond CloudFront's general access response; this belongs to rule-level web firewall decision evidence, while the problem is centralized administrative event collection across accounts.

Resource history captures posture while control-plane event records associate modifications with specific authenticated callers; this changes auditable private endpoint policy changes, not the necessary centralized administrative event collection across accounts.

Administrative deletion is a control-plane operation and appears in audit events, not inside the removed flow-log stream itself; this belongs to investigation of log-tampering administration events, while the problem is event-triggered alerting for network compliance findings.

Config tracks supported resource states and changes over time for posture reconstruction; this changes long-term history of firewall rule configuration, not the necessary event-triggered alerting for network compliance findings.

In the automated verification of load-balancer logging posture workflow, configuration assessment can flag resources that violate the required monitoring policy without sampling their live traffic; the current case needs event-triggered alerting for network compliance findings.

Delivery configuration and IAM authorization must both allow log-stream creation and event publication; that addresses authorized publication of VPC flow telemetry, rather than selecting the right logging layer for HTTP investigation.

Centralized log custody and controlled permissions reduce risk that workload operators can erase records of network activity; this belongs to tamper-resistant multi-account network flow retention, while the problem is selecting the right logging layer for HTTP investigation.

In the rejected flow evidence across VPC environments workflow, flow logs record accept/reject decisions and packet metadata at the chosen aggregation scope; the current case needs selecting the right logging layer for HTTP investigation.

This produces web request forensic evidence beyond network metadata: ALB access logging contains structured HTTP request details, while complete custom header capture may require application-level instrumentation; the stem instead tests selecting the right logging layer for HTTP investigation.

CloudTrail captures management-plane changes and principals; it cannot enumerate all allowed network paths satisfying a policy across current security groups and routes.

Flow Logs record observed flows, not every path configuration could allow. Lack of observed traffic does not prove that an unintended route and security combination is absent.

Resolver query records reveal DNS lookup activity, not reusable network-path policy violations against subnets, interfaces, routing tables and security groups.

Config tracks supported resource states and changes over time for posture reconstruction; that addresses long-term history of firewall rule configuration, rather than distinguishing logged denial from exact blocking control.

Network flow summaries do not include HTTP payload and URI content, so a different telemetry layer is required; this belongs to selecting the right logging layer for HTTP investigation, while the problem is distinguishing logged denial from exact blocking control.

Athena provides SQL-style analysis over supported S3 log formats, enabling correlation across separately collected telemetry sources; this changes cross-log correlation over retained S3 security evidence, not the necessary distinguishing logged denial from exact blocking control.

CloudTrail records supported network control-plane API calls and actor metadata, unlike per-packet flow logs; that addresses principal attribution for transit route modifications, rather than auditable private endpoint policy changes.

Configuration history and periodic verification detect changed mirror targets or filters even when captured traffic volume seems normal; this belongs to accountability for packet capture destination changes, while the problem is auditable private endpoint policy changes.

Config tracks supported resource states and changes over time for posture reconstruction; this changes long-term history of firewall rule configuration, not the necessary auditable private endpoint policy changes.

WAF request logs show rule evaluation and final actions, providing decision evidence beyond CloudFront's general access response; this belongs to rule-level web firewall decision evidence, while the problem is quantitative monitoring of web firewall rule activity.

ALB access logging contains structured HTTP request details, while complete custom header capture may require application-level instrumentation; this changes web request forensic evidence beyond network metadata, not the necessary quantitative monitoring of web firewall rule activity.

In the cross-log correlation over retained S3 security evidence workflow, athena provides SQL-style analysis over supported S3 log formats, enabling correlation across separately collected telemetry sources; the current case needs quantitative monitoring of web firewall rule activity.

ALB access logging contains structured HTTP request details, while complete custom header capture may require application-level instrumentation; that addresses web request forensic evidence beyond network metadata, rather than flow rejection records and IAM CloudTrail actor attribution.

Reachability Analyzer evaluates current modeled networking controls and explains why a path is possible or blocked; this belongs to auditing configuration-permitted network access paths, while the problem is flow rejection records and IAM CloudTrail actor attribution.

In the VPN tunnel state-based incident alarms workflow, tunnelState metrics allow automated assessment of link status; aggregation periods reduce noise from transient samples; the current case needs flow rejection records and IAM CloudTrail actor attribution.

Reachability Analyzer evaluates current modeled networking controls and explains why a path is possible or blocked; that addresses auditing configuration-permitted network access paths, rather than accountability for packet capture destination changes.

Config tracks supported resource states and changes over time for posture reconstruction; this belongs to long-term history of firewall rule configuration, while the problem is accountability for packet capture destination changes.

Resource history captures posture while control-plane event records associate modifications with specific authenticated callers; this changes auditable private endpoint policy changes, not the necessary accountability for packet capture destination changes.

This produces payload-level packet collection for network investigations: VPC Traffic Mirroring copies packets for authorized deep inspection, while aggregated flows omit payload contents; the stem instead tests accountability for packet capture destination changes.

Resource history captures posture while control-plane event records associate modifications with specific authenticated callers; that addresses auditable private endpoint policy changes, rather than investigation of log-tampering administration events.

CloudTrail records supported network control-plane API calls and actor metadata, unlike per-packet flow logs; this belongs to principal attribution for transit route modifications, while the problem is investigation of log-tampering administration events.

Delivery configuration and IAM authorization must both allow log-stream creation and event publication; this changes authorized publication of VPC flow telemetry, not the necessary investigation of log-tampering administration events.