Question

A SysOps administrator is troubleshooting an application server in a private subnet that intermittently fails to complete requests to a third-party payment API over the internet. The instance's outbound path uses a NAT gateway. VPC Flow Logs for the instance's ENI show records with ACCEPT for the outbound TCP connections to the API's IP, but there are NO corresponding inbound ACCEPT or REJECT records for the return traffic. The security group is stateful and allows all outbound traffic. What is the MOST likely cause of the missing return traffic?

Accepted Answer

The NAT gateway has reached its port allocation limit for the destination, so the return packets never arrive at the instance's ENI and are not logged.

Answer

A network ACL on the private subnet is denying the inbound return traffic on ephemeral ports, causing the response packets to be dropped before reaching the ENI.

Answer

The security group is blocking the inbound response because security groups are stateless and require an explicit inbound rule for return traffic.

Answer

VPC Flow Logs only capture outbound traffic for instances behind a NAT gateway, so the absence of inbound records is expected behavior and not an issue.