- Adds DDoS attack flow logs to Shield Advanced, providing packet‑level visibility during attacks
- Logs are automatically delivered to S3, CloudWatch Logs, or Kinesis Data Firehose every 5 minutes for forensic analysis and compliance reporting
- Feature is available in all Shield Advanced regions and requires enabling on protected resources with a configured destination