1. AWS Documentation, VPC User Guide, "Traffic mirroring": "Traffic mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of an Amazon EC2 instance. You can then send the traffic to out-of-band security and monitoring appliances for deep packet inspection, content inspection, threat monitoring, and troubleshooting."
2. AWS Documentation, VPC User Guide, "Traffic mirroring targets": This section explicitly lists the valid targets for mirrored traffic. It states, "You can send the mirrored traffic to the following targets: A network interface [or] A Network Load Balancer that has a UDP listener." This confirms that an NLB is a supported target.
3. AWS Documentation, VPC User Guide, "VPC Flow Logs": "Flow logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC... Flow log data does not capture the contents of the traffic." This confirms that flow logs are insufficient for content inspection.
