Question

A SysOps administrator is troubleshooting why an EC2 instance in a private subnet cannot reach an EC2 instance in another private subnet within the same VPC. Security groups and NACLs have already been verified as permissive for the required traffic. The administrator wants an AWS-native tool that will analyze the network path between the two ENIs and identify the specific configuration component blocking the connection, without sending any actual traffic. Which approach should the administrator use?

Accepted Answer

Run VPC Reachability Analyzer between the two elastic network interfaces to produce a hop-by-hop path analysis identifying the blocking component.

Answer

Enable VPC Flow Logs on both subnets and wait for REJECT records to appear before determining the cause.

Answer

Launch a bastion host and use ping and traceroute from the source instance to trace the network path.

Answer

Use Amazon CloudWatch Network Monitor to continuously probe the destination and alert on packet loss.