GlassRiver Bank’s SOC detected potential exfiltration to 198.51.100.77:443. VPC Flow Logs are enabled to CloudWatch Logs with the default fields. They need to quickly identify which EC2 instance initiated the traffic. What should the analyst do?

VPC Flow Logs record IP traffic information for network interfaces. Searching Flow Logs for dstaddr=198.51.100.77 and action=ACCEPT will identify the network interface(s) that successfully communicated with the suspicious IP. The interface-id field in the Flow Logs can then be used with DescribeNetworkInterfaces to determine which EC2 instance owns that network interface, thus identifying the source of the traffic. Enabling Flow Logs on a NAT Gateway would show traffic through the NAT Gateway, but not the originating instance ID directly. CloudTrail records API calls and management events, not network flow data, so it wouldn't show outbound TCP connections. VPC Traffic Mirroring captures live traffic and cannot be used retrospectively to analyze past events.