Abstract: Techniques for identifying unencrypted network flows using virtual private cloud encryption controls are described. An encryption control system in a cloud provider network receives a request to monitor an encryption state of network traffic associated with a virtual private cloud (VPC). Based on collected network flow data indicative of an encryption state associated with each network flow, the system identifies a network flow associated with the VPC as not being encrypted. This identified network flow, which may be present in the VPC or in underlying architecture of the cloud provider network, can be presented via a user interface.