{
  "id": 6759509,
  "title": "How AWS Lambda logs every flow across thousands of microVMs per host with eBPF and Rust",
  "url": "https://urgent.news/2026/09/11/how-aws-lambda-logs-every-flow-across-thousands-of-microvms-per-host",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-11T12:00:00.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/aws-lambda-ebpf-rust/"
  },
  "original_language": "en",
  "account": "Every Lambda worker is a bare-metal EC2 instance with microVMs isolated by Firecracker. Workloads are networked to S3, other AWS services, the public internet, and a customer's VPC. A network flow log logs every packet flow, helping with investigation, incident response, audit, and reconstructing what happened to a workload. The log must be complete, correctly attributed, and cause almost no overhead to the network flow and platform. The old architecture ran into two problems: rule explosion due to iptables and lack of IPv6 support. To solve these issues, the new system uses eBPF programs attached to traffic-control hooks on each network. These programs emit one compact event per packet into a ring buffer, intercepting packets without modifying them. A Rust user-space tagger reads from the ring buffer and creates Ion records, maintaining byte-for-byte identical records.",
  "summary": "On any compute platform, when a security alert fires, the question is always the same. Which workload talked to that The post How AWS Lambda logs every flow across thousands of microVMs per host with eBPF and Rust appeared first on The New Stack .",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}