Building a RAG-Based AWS VPC Flow Log Analyzer

If you’ve ever opened a raw VPC Flow Log file, you know the feeling with thousands of lines of space-delimited fields, IPs, ports, packet counts, and timestamps. Somewhere in there is the answer to your question. You just have to find it. Was that SSH connection rejected? Which IP keeps hitting port 443? Is this traffic normal or a problem? Manually digging through VPC Flow Logs is slow, reactive, and honestly painful. It usually means grepping through files, exporting to spreadsheets, or writing one-off scripts just to answer simple questions. What if you could just ask your logs? In this article, we’ll build a Retrieval-Augmented Generation (RAG) powered VPC Flow Log Analyzer that turns static network telemetry into an interactive security assistant The Challenge of Manual Log Analysis AWS VPC Flow Logs capture essential information about network traffic. Yet, analysing these raw logs to detect threats like SQL injection attempts or unauthorised access presents significant challenges