Networking flow logs for multi-tenant environments

A computer-implemented method, comprising:

• receiving, at a computing resource service provider, a request to collect network log information related to a virtual computer system instance of a customer, the computing resource service provider managing a plurality of virtual computer system instances for different customers;
• filtering, by a firewall, during a sampling period, network traffic directed to the virtual computer system instance;
• obtaining the network log information by filtering the network traffic directed to the virtual computer system instance during the sampling period;
• retrieving, from the network log information, network information associated with the virtual computer system instance, the network information including at least a source internet protocol (IP) address, a destination IP address, and information identifying a protocol used;
• and
• providing the network log information to a destination associated with the customer.

A system, comprising:

• one or more processors;
• and
• memory that includes instructions that, as a result of being executed by the one or more processors, cause the system to:
• obtain a request from a customer, of a plurality of customers, of a computing resource service provider to enable logging for a virtual computer system instance supported by computing resources of the system;
• obtain one or more data packets at a network interface of the system, during a sampling period, where the one or more data packets are associated with a set of network flows directed to the virtual computer system instance;
• filter the one or more data packets at a firewall based at least in part on one or more security policies, where the one or more security policies indicate whether to allow or deny a particular data packet based at least in part on information contained in the particular data packet, the information including at least a source internet protocol (IP) address, a destination IP address, and information identifying a protocol used;
• as a result of enabling the logging, obtain log information corresponding to both the filtering of the one or more data packets and a set of actions performed by the firewall in the filtering of the one or more data packets;
• and
• provide the log information to a destination accessible to the customer.

A set of non-transitory computer-readable storage media having collectively stored thereon executable instructions that, as a result of being executed by one or more processors of a set of computer systems, cause at least a subset of the set of computer systems to at least:

• obtain a request from a customer of a computing resource service provider to enable logging for a virtual computer system instance supported by a set of computing resources hosted by the computing resource service provider;
• based at least in part on one or more security policies, filter network traffic at a firewall, at least a portion of the network traffic directed to the set of computing resources used at least in part to support the virtual computer system instance managed by the customer, where the one or more security policies indicate whether to allow or deny a particular data packet based at least in part on information contained in the particular data packet, the information including at least a source internet protocol (IP) address, a destination IP address, and information identifying a protocol used;
• as a result of fulfillment of the request, obtain, from the firewall, network traffic log information corresponding to the virtual computer system instance;
• and
• provide the network traffic log information to a storage service for persistent storage.