VPC Flow Logs provides workload-level attribution for L3/L4 traffic without deploying extra agents or sidecars.