AWS Network Logs

Vendor key: aws_network. For how source fields and scan configs fit together, see Agent Discovery Integrations.

Reads network logs from Amazon CloudWatch Logs log groups in one AWS region and reports each internal source seen calling a host that serves model inference. Arthur's built-in list covers OpenAI, Anthropic, Amazon Bedrock, Azure OpenAI and AI Foundry, Gemini and Vertex AI, Mistral, Cohere, Groq, OpenRouter, Together, DeepSeek, xAI, Perplexity and Fireworks, and you can add your own hosts and ranges. To cover more regions, add one source for each.

Arthur reports one agent per EC2 instance. When a line names no instance, it reports one per network interface, and otherwise one per address in its VPC. A line that names only an address and no VPC is counted in the scan log and skipped, because the same address in two VPCs is two different hosts.

Before you start

Send the logs you want Arthur to read to CloudWatch Logs: Route 53 Resolver query logs, VPC Flow Logs in the default format, or your own format.

For step-by-step instructions, see Resolver query logging or Publish flow logs to CloudWatch Logs in the AWS documentation.

Source fields

Field	Required	Sensitive	Default	Description
`region`	Yes	No		The AWS region of the log groups, for example `us-east-1`.
`log_group_names`	Yes	No		Comma-separated log groups that hold the network logs, up to 20, for example `/aws/route53resolver/prod-vpc`. Give a log group shared into a monitoring account by its ARN.
`log_format`	Yes	No		`route53_resolver_query_log` (Route 53 Resolver query logs), `vpc_flow_log_v2` (VPC Flow Logs, default format), or `custom` to read lines with `extraction_regex`.
`extraction_regex`	Yes*	No		A regex with named groups. `src` (the internal source) and `dest` (the hostname or IP it called) are required. `instance_id`, `interface_id`, `vpc_id`, `account_id` and `timestamp` are optional, but a line needs `instance_id`, `interface_id` or `vpc_id` to be placed. `(?<name>...)` and `(?P<name>...)` both work. At most 2048 characters. For example `src=(?<src>\S+) vpc=(?<vpc_id>\S+) dst_host=(?<dest>\S+)`.
`access_key_id`	No	No		An IAM access key ID, for example `AKIAIOSFODNN7EXAMPLE`. Set it together with `secret_access_key`.
`secret_access_key`	No	Yes		The secret of the IAM access key.
`role_arn`	No	No		An IAM role to assume before reading, for log groups in another account or for a credential with no log permissions of its own. For example `arn:aws:iam::123456789012:role/arthur-discovery`.
`external_id`	No	No		The external ID the role's trust policy requires. Sent only when assuming `role_arn`.
`extra_inference_hosts`	No	No	None	Comma-separated destinations to treat as inference endpoints in addition to the built-in list, up to 100, for example `llm-gateway.example.com, 10.50.0.0/16`. A host also matches its subdomains, and `*` stands for part of one label. IP addresses and CIDR ranges also work.

* Required when log_format is custom, and read only then.

Leave access_key_id and secret_access_key empty only if your Arthur engine is configured to use its own AWS credentials (ARTHUR_ENGINE_AWS_NETWORK_ALLOW_DEFAULT_CREDENTIALS=true).

VPC Flow Logs carry only IP addresses, and the large model providers serve from shared CDN addresses. With vpc_flow_log_v2, only the ranges in extra_inference_hosts match. A source identified by its address is weaker evidence than an instance, because Lambda functions, containers and pods share and reuse VPC addresses.

Scan config

Setting	Value
`query`	`""`. The log format is set on the source, and a scan config's query is ignored.
`query_language`	`none`
`lookback_window_seconds`	The time range of log events read. `0` reads everything the log groups retain.

A scan reads at most 1,000,000 log events. A scan that reaches the cap says so in its log rather than reporting itself complete. Arthur matches each line with a 50 ms limit and skips lines longer than 16 KiB, so a regex that backtracks badly skips lines, counted in the scan log, instead of holding up the scan.

Required permissions

logs:FilterLogEvents on the log groups.
sts:AssumeRole on role_arn. Needed only if you set role_arn.

No other permissions are needed. For least privilege, grant a custom policy with just these actions, scoped to the log groups.