What's changed: In-scope coverage: added ops/notification/governance (EventBridge/SNS/SQS/Health Dashboard/Trusted Advisor/Well-Architected/Management Console/Control Tower)
5.3Troubleshooting and Optimizing Connectivity
Isolate and fix—understand route tables, security groups (stateful), NACLs (stateless), MTU/jumbo frames, and asymmetric routing. Systematically find the cause.
When something "can’t connect," isolate systematically: check route → security group → NACL, then confirm with REJECT entries in flow logs.
5.3.1Order of isolation
- Route table: is there a route to the target (IGW/NAT/TGW/peering/endpoint)?
- Security group: stateful. Allow inbound and the return traffic is automatically allowed.
- NACL: stateless. Must explicitly allow both inbound and outbound (incl. ephemeral ports).
- MTU/asymmetric routing: mind jumbo frames/MTU for large packets; different forward/return paths can break flows.
Common on ANS-C01: SG is stateful (return auto-allowed), NACL is stateless (allow both directions, mind ephemeral ports), isolate route → SG → NACL first, and exact blocking point = Reachability Analyzer. A classic root cause: a NACL blocking ephemeral return ports.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.