A timeout says that something dropped the connection, not what. A flow log records the connections in a VPC, one line each, and says which were accepted and which rejected.

Turning it on

aws ec2 create-flow-logs --resource-type VPC --resource-ids $VPC --traffic-type REJECT --log-destination-type cloud-watch-logs --log-group-name /market/flow --deliver-logs-permission-arn arn:aws:iam::123456789012:role/flow-logs

• --traffic-type is ACCEPT, REJECT or ALL.
• Records go to a log group in CloudWatch Logs, AWS's store for logs (Chapter 10 covers it).
• The flow log service writes them with a role that trusts vpc-flow-logs.amazonaws.com, like an instance profile trusts EC2. This account's flow-logs role is ready.

Reading it

aws logs filter-log-events --log-group-name /market/flow --filter-pattern REJECT --query "events[].message" --output text

--filter-pattern keeps the records that contain the word. Each record is one line of fields:

This one says that 203.0.113.10 tried port 22 on 10.0.1.25 and was refused. A stream of REJECTs on one port from many addresses is someone scanning; a single REJECT on your own app's port is a rule you forgot.