Configure traffic mirror using AWS documentation and deploy a virtual Network Security instance in AWS in TAP or SPAN mode. Traffic mirroring copies the traffic to the network interfaces that are attached to your Network Security instance.
Traffic mirroring uses the following items:
Source—The source of the mirrored traffic.
Target—The destination for the mirrored traffic (a monitoring interface on the Network Security instance).
Filter—A set of rules that defines the traffic that is copied in a traffic mirror session.
Session—An entity that establishes the relationship between the source and target using the filter created for the traffic.
Traffic mirroring requires the following tasks:
Identifying the traffic mirror source and making sure the requirements for it are met (for example, making sure the source has a route table entry for the traffic mirror target).
Creating the traffic mirror filter and filter rules.
Configuring the traffic mirror target.
Creating the traffic mirror session.
For more information about traffic mirroring and detailed instructions for implementing it, see the Amazon AWS VPC traffic monitoring documentation.