Question

A network operations team wants to reduce the recurring cost of their monitoring stack. They currently run a custom EC2-based probe that continuously sends synthetic TCP connections between two ENIs across VPCs attached to a Transit Gateway, solely to confirm that a valid network path (routes, security groups, NACLs) exists after periodic infrastructure changes. The path rarely changes and only needs to be re-verified after each CloudFormation deployment. Which approach validates the path most cost-effectively while requiring no persistent compute?

Accepted Answer

Trigger a VPC Reachability Analyzer path analysis between the source and destination ENIs as a post-deployment step in the CloudFormation pipeline, evaluating the returned path status.

Answer

Enable VPC Flow Logs on both ENIs and run scheduled Athena queries to confirm that ACCEPT records appear between the two endpoints.

Answer

Deploy a CloudWatch Synthetics canary that opens a TCP connection between the ENIs every minute and alarms on failures.

Answer

Configure a CloudWatch Network Monitor probe between the two subnets to continuously measure packet loss and connectivity.