Question

A SysOps administrator is troubleshooting why an EC2 instance in a private subnet cannot receive traffic from an on-premises server over a Site-to-Site VPN. The administrator enables VPC Flow Logs on the instance's ENI and sees records where the action field shows REJECT for inbound traffic from the on-premises CIDR on TCP port 443, while the outbound response entries are absent. The security group already allows inbound 443 from the on-premises CIDR. What is the MOST likely cause of the rejected traffic?

Accepted Answer

The network ACL associated with the private subnet is missing an inbound rule allowing TCP 443 from the on-premises CIDR.

Answer

The security group is stateful, so the missing outbound rule for the ephemeral port range is blocking the return traffic.

Answer

VPC Flow Logs only capture accepted traffic, so the REJECT entries indicate a logging misconfiguration rather than a real block.

Answer

The instance's route table lacks a route to the on-premises CIDR via the virtual private gateway, causing the packets to be dropped at the ENI.