Question

A network engineer is troubleshooting why an EC2 application server in a private subnet cannot reach an RDS instance in another subnet within the same VPC. Security groups appear correctly configured to allow the traffic on port 5432. The engineer wants to identify the exact hop where the path breaks without generating live test traffic or modifying the application. Which approach provides the fastest, most precise root-cause identification?

Accepted Answer

Run VPC Reachability Analyzer specifying the EC2 ENI as the source and the RDS ENI as the destination on TCP port 5432, and review the returned path or blocking component.

Answer

Enable VPC Flow Logs on both subnets and wait for the application to retry the connection, then filter for REJECT records to find the blocking rule.

Answer

Launch a bastion host in the private subnet and run continuous traceroute and telnet tests toward the RDS endpoint to locate the failure point.

Answer

Use CloudWatch Internet Monitor to visualize the traffic path and detect where packets are being dropped between the two subnets.