Transit gateway flow logs plus Athena told us which of 130 AWS accounts were crossing the sandbox/nonprod/prod boundary, for about 45 cents of query spend. Here is the capture pattern, the queries, the five things that skew the results, and how we turned raw IPs into something a team would act on.
September 2, 2026
Linkedin