An operator needs to know whether packets to a private instance were accepted or rejected at its network interface during an incident. Which data source is most appropriate?

1. Route 53 query logs as a capture of all TCP payloads.
2. VPC Flow Logs with the relevant interface, time range, addresses, ports, and action fields.
3. CloudTrail management events as a complete packet log.
4. EC2 instance tags as historical connection records.