Question

A network operations team manages several critical paths in a large VPC environment, including connectivity from an application EC2 instance to an RDS database across subnets. Recently, an unauthorized security group change silently broke this path for hours before anyone noticed. The team wants an automated, ongoing verification that continuously confirms the intended network path remains reachable and alerts them within minutes when a configuration change breaks it. Which approach best meets this requirement with the least custom development?

Accepted Answer

Use Reachability Analyzer with a defined path, and configure an EventBridge scheduled rule that invokes a Lambda function to start the analysis periodically, publishing results and alerting via SNS when the path status is 'not reachable'.

Answer

Enable VPC Flow Logs on the relevant ENIs and create a CloudWatch Logs metric filter that alarms when REJECT records appear between the instance and the database.

Answer

Create a Network Access Analyzer scope and run it manually each morning to detect any unintended network access paths.

Answer

Configure AWS Config with a managed rule that evaluates security group rules and sends an SNS notification whenever any security group is modified.