Network Management and Operation

A network operations team manages all VPC security groups, route tables, and NACLs through a CloudFormation stack to enforce a consistent baseline. During an incident, an engineer manually added an inbound rule to a security group via the console to restore service quickly. Weeks later, the team wants to programmatically identify every resource in the stack whose live configuration no longer matches the template, without disrupting running resources. Which approach meets this requirement with the least operational effort?

A network operations team manages 40 AWS accounts under a single AWS Organizations structure. They need to deploy an identical set of interface VPC endpoints (for SSM, EC2 Messages, and CloudWatch Logs) into a standard VPC in every account, and ensure that any newly created account automatically receives the same endpoints without manual intervention. The solution must minimize ongoing operational effort. Which approach best meets these requirements?

A network operations team runs a fleet of EC2 instances behind a custom TCP proxy on Nitro-based instance types. Applications intermittently report dropped connections during traffic spikes, but VPC Flow Logs show no REJECT entries and the instances' CPU and memory are healthy. The team suspects the instances are hitting Nitro network performance allowances (such as bandwidth or packet-per-second limits) that cause packets to be queued or dropped. Which approach provides the specific metrics needed to confirm this hypothesis?

A company runs a Site-to-Site VPN connection to AWS with two tunnels for redundancy. The network operations team wants to be automatically notified within a few minutes whenever either tunnel changes state, and they want to trigger a Lambda function that pages the on-call engineer. They must use native AWS metrics without deploying any agents. Which approach meets these requirements with the least operational overhead?

A global e-commerce company hosts its application on EC2 behind an Application Load Balancer in us-east-1, with CloudFront in front. Users in Southeast Asia have started reporting slow page loads and intermittent errors over the past two days, but internal synthetic canaries running from AWS regions show healthy latency. The network operations team needs to determine whether the degradation is caused by internet path issues (such as an ISP or transit provider problem) affecting specific city/ASN combinations, and quantify the impact on real users without deploying agents. Which AWS capability should the team use?

A network operations team stores VPC Flow Logs in a CloudWatch Logs log group. During an unexpected NAT gateway data-processing cost spike, an engineer must quickly identify which private instances (source IP addresses) generated the most outbound bytes over the last 3 hours, without deploying additional infrastructure. What is the FASTEST approach to produce this ranked list?

A network operations team runs a Transit Gateway connecting 12 VPCs across a region. Users in one VPC report intermittent slow transfers to a shared services VPC. The team suspects a specific TGW attachment is hitting a throughput ceiling but needs data to confirm before escalating. Without deploying any agents, which approach gives the team the fastest way to identify whether that attachment is saturating its bandwidth limit?

A company runs a critical application in a VPC that communicates with an on-premises database over an AWS Direct Connect connection. Users intermittently report slow response times, but the Direct Connect virtual interface metrics and BGP session appear healthy. The network team needs a managed AWS solution that continuously measures round-trip latency and packet loss between the VPC subnets and the on-premises database endpoint, with minimal agent installation and near-real-time CloudWatch metrics for alerting. Which approach best meets these requirements?

A financial services company exposes an internal REST API through an Application Load Balancer reachable only within their VPC. The network operations team wants proactive alerting when the API's HTTPS response latency exceeds a threshold or when the endpoint returns error codes, even during periods with no customer traffic. The monitoring must run from within the private network context and generate CloudWatch metrics and alarms. Which approach best meets these requirements with the least operational overhead?

A global enterprise operates a Transit Gateway spanning three AWS Regions with dozens of VPC and VPN attachments managed under a single AWS Cloud WAN / Network Manager global network. The operations team wants a proactive alert whenever a Site-to-Site VPN tunnel associated with any attachment changes state (up/down) or when BGP routing convergence issues occur, without writing custom polling scripts against each individual VPN connection. Which approach best meets this requirement?

A company operates a global network built on multiple Transit Gateways across three AWS Regions, several Site-to-Site VPN connections, and two Direct Connect gateways spanning many accounts. The network operations team currently logs into each account and Region separately to check attachment states and route propagation, which delays incident response. They want a single, centralized visualization of the entire cross-Region topology and the ability to be alerted when a TGW attachment or route-table state changes, without deploying custom polling scripts. Which solution best meets these requirements?

A network engineer manages a large multi-Region global network built on multiple Transit Gateways registered in AWS Cloud WAN's predecessor tooling via AWS Network Manager. After a routing change, an application team reports that traffic from a VPC attached to the us-east-1 Transit Gateway cannot reach a VPC attached to the eu-west-1 Transit Gateway, even though a peering attachment exists. The engineer needs to determine, without generating live traffic, whether the Transit Gateway route tables on both ends have the correct routes and where the path breaks. Which AWS Network Manager capability should the engineer use?

A network operations team manages several critical paths in a large VPC environment, including connectivity from an application EC2 instance to an RDS database across subnets. Recently, an unauthorized security group change silently broke this path for hours before anyone noticed. The team wants an automated, ongoing verification that continuously confirms the intended network path remains reachable and alerts them within minutes when a configuration change breaks it. Which approach best meets this requirement with the least custom development?

A network operations team wants to reduce the recurring cost of their monitoring stack. They currently run a custom EC2-based probe that continuously sends synthetic TCP connections between two ENIs across VPCs attached to a Transit Gateway, solely to confirm that a valid network path (routes, security groups, NACLs) exists after periodic infrastructure changes. The path rarely changes and only needs to be re-verified after each CloudFormation deployment. Which approach validates the path most cost-effectively while requiring no persistent compute?

A financial services company runs a Lambda function attached to a private subnet that intermittently fails to reach an on-premises database over a Site-to-Site VPN. During failures, the CloudWatch metrics show no errors on the VPN tunnels, and the tunnels report UP. The network team suspects that Lambda is exhausting available Hyperplane ENIs or private IP addresses in the subnet during scaling events. Which action MOST directly confirms whether subnet IP address exhaustion is the root cause?

A network engineer is troubleshooting why an EC2 application server in a private subnet cannot reach an RDS instance in another subnet within the same VPC. Security groups appear correctly configured to allow the traffic on port 5432. The engineer wants to identify the exact hop where the path breaks without generating live test traffic or modifying the application. Which approach provides the fastest, most precise root-cause identification?

A network engineer is troubleshooting an application that experiences intermittent connection failures between an EC2 instance in a private subnet and an RDS database in another subnet within the same VPC. A previous Reachability Analyzer path analysis between the two ENIs returned a status of 'Reachable', yet users still report periodic timeouts during peak traffic hours. Which action will best help the engineer identify the root cause of the intermittent failures?

A company runs a hub-and-spoke topology using a Transit Gateway with multiple VPC attachments across three Availability Zones. Application teams report intermittent high latency for east-west traffic between two spoke VPCs, but only for flows that traverse different AZs. The network team must confirm whether traffic is being hairpinned across AZs at the Transit Gateway before opening a support case. Which action provides the most direct evidence of the cross-AZ traffic behavior?

A media company runs a large file-transfer workload between two VPCs attached to the same AWS Transit Gateway. On-premises testing showed high throughput using 9001-byte jumbo frames, but after migrating to AWS the application experiences sporadic large-payload failures and reduced throughput. A packet capture on the receiving instance shows that some large packets never arrive, while smaller packets pass normally. The instances themselves are configured with an MTU of 9001. What is the most likely cause and the correct remediation?

A network operations team manages a large multi-account environment with a Transit Gateway connecting 40 VPCs across two regions. They need to automatically detect and respond whenever a new VPC attachment is created or a route table association changes on the Transit Gateway, triggering a Lambda function that validates the change against a compliance policy. The solution must be event-driven with minimal polling and no custom infrastructure to watch for changes. Which approach best meets these requirements?