aws-network-diagnostics

name	aws-network-diagnostics
description	Debugging AWS network connectivity issues including Amazon Virtual Private Cloud (Amazon VPC), security groups, network ACLs (NACLs), route tables, VPC endpoints, DNS, load balancers, and AWS Transit Gateway. Use when troubleshooting connectivity failures or validating network paths.

AWS Network Diagnostics Skill

Security: Always ensure diagnosed resources meet or exceed the security configuration of the source resources. Refer to SECURITY.md for security requirements.

VPC Reachability Analyzer (Recommended)

# Create analysis path
aws ec2 create-network-insights-path --source <eni-or-instance-id> --destination <eni-or-instance-id> --protocol TCP --destination-port <port> --region <region>

# Start analysis
aws ec2 start-network-insights-analysis --network-insights-path-id <path-id> --region <region>

# Get results
aws ec2 describe-network-insights-analyses --network-insights-analysis-ids <analysis-id> --region <region> --query 'NetworkInsightsAnalyses[0].{Reachable:NetworkPathFound,Explanations:Explanations}'

Security Group Checks

# Check inbound rules for a SG
aws ec2 describe-security-groups --group-ids <sg-id> --region <region> --query 'SecurityGroups[0].IpPermissions[*].{Proto:IpProtocol,FromPort:FromPort,ToPort:ToPort,Sources:IpRanges[*].CidrIp,SGSources:UserIdGroupPairs[*].GroupId}'

# Check outbound rules
aws ec2 describe-security-groups --group-ids <sg-id> --region <region> --query 'SecurityGroups[0].IpPermissionsEgress[*].{Proto:IpProtocol,FromPort:FromPort,ToPort:ToPort,Dest:IpRanges[*].CidrIp}'

# Find SGs attached to an instance
aws ec2 describe-instances --instance-ids <id> --region <region> --query 'Reservations[0].Instances[0].SecurityGroups'

# Find SGs allowing a specific port
aws ec2 describe-security-groups --filters "Name=ip-permission.from-port,Values=<port>" "Name=ip-permission.to-port,Values=<port>" --region <region> --query 'SecurityGroups[*].{ID:GroupId,Name:GroupName}'

NACL Checks

# Get NACLs for a subnet
aws ec2 describe-network-acls --filters "Name=association.subnet-id,Values=<subnet-id>" --region <region> --query 'NetworkAcls[0].Entries[*].{Rule:RuleNumber,Action:RuleAction,Proto:Protocol,CIDR:CidrBlock,Ports:PortRange,Egress:Egress}' --output table

Route Table Checks

# Get routes for a subnet
aws ec2 describe-route-tables --filters "Name=association.subnet-id,Values=<subnet-id>" --region <region> --query 'RouteTables[0].Routes[*].{Dest:DestinationCidrBlock,Target:GatewayId||NatGatewayId||TransitGatewayId||VpcPeeringConnectionId,State:State}'

# Check if subnet is public (has route to IGW)
aws ec2 describe-route-tables --filters "Name=association.subnet-id,Values=<subnet-id>" --region <region> --query 'RouteTables[0].Routes[?GatewayId!=`null` && starts_with(GatewayId,`igw-`)]'

VPC Endpoints

# List VPC endpoints
aws ec2 describe-vpc-endpoints --filters "Name=vpc-id,Values=<vpc-id>" --region <region> --query 'VpcEndpoints[*].{ID:VpcEndpointId,Service:ServiceName,Type:VpcEndpointType,State:State}'

# Check endpoint policy
aws ec2 describe-vpc-endpoints --vpc-endpoint-ids <ep-id> --region <region> --query 'VpcEndpoints[0].PolicyDocument'

DNS Resolution

# Check VPC DNS settings
aws ec2 describe-vpc-attribute --vpc-id <vpc-id> --attribute enableDnsSupport --region <region>
aws ec2 describe-vpc-attribute --vpc-id <vpc-id> --attribute enableDnsHostnames --region <region>

# Check Route 53 resolver rules
aws route53resolver list-resolver-rules --region <region> --query 'ResolverRules[*].{ID:Id,Domain:DomainName,Type:RuleType,Status:Status}'

# From EC2 instance: test DNS resolution
# dig <hostname>
# nslookup <hostname>
# host <hostname>

Load Balancer Diagnostics

# ALB health check status
aws elbv2 describe-target-health --target-group-arn <tg-arn> --region <region> --query 'TargetHealthDescriptions[*].{Target:Target.Id,Port:Target.Port,State:TargetHealth.State,Reason:TargetHealth.Reason}'

# ALB listener rules
aws elbv2 describe-rules --listener-arn <listener-arn> --region <region>

# NLB target health
aws elbv2 describe-target-health --target-group-arn <tg-arn> --region <region>

# Classic ELB health
aws elb describe-instance-health --load-balancer-name <name> --region <region>

NAT Gateway

# Check NAT Gateway status
aws ec2 describe-nat-gateways --filter "Name=vpc-id,Values=<vpc-id>" --region <region> --query 'NatGateways[*].{ID:NatGatewayId,State:State,Subnet:SubnetId,PublicIP:NatGatewayAddresses[0].PublicIp}'

VPC Peering

# Check peering status
aws ec2 describe-vpc-peering-connections --filters "Name=requester-vpc-info.vpc-id,Values=<vpc-id>" --region <region> --query 'VpcPeeringConnections[*].{ID:VpcPeeringConnectionId,Status:Status.Code,Peer:AccepterVpcInfo.VpcId,PeerRegion:AccepterVpcInfo.Region}'

Transit Gateway

# Check TGW attachments
aws ec2 describe-transit-gateway-attachments --filters "Name=transit-gateway-id,Values=<tgw-id>" --region <region> --query 'TransitGatewayAttachments[*].{ID:TransitGatewayAttachmentId,Type:ResourceType,Resource:ResourceId,State:State}'

# Check TGW route table
aws ec2 search-transit-gateway-routes --transit-gateway-route-table-id <rt-id> --filters "Name=state,Values=active" --region <region>

VPC Flow Logs

# Check if flow logs are enabled
aws ec2 describe-flow-logs --filter "Name=resource-id,Values=<vpc-id>" --region <region>

# Query flow logs via CloudWatch Insights
aws logs start-query --log-group-name <flow-log-group> --start-time $(date -d '1 hour ago' +%s) --end-time $(date +%s) --query-string '
  fields @timestamp, srcAddr, dstAddr, srcPort, dstPort, protocol, action
  | filter dstPort = <port> and action = "REJECT"
  | sort @timestamp desc
  | limit 50
' --region <region>

Advanced: CLI-Based Connectivity Tests (from EC2)

# TCP connectivity test
# nc -zv <host> <port> -w 5

# Traceroute
# traceroute -T -p <port> <host>

# MTR (continuous traceroute)
# mtr --tcp --port <port> <host> --report

# curl with timing
# curl -o /dev/null -s -w "DNS:%{time_namelookup} Connect:%{time_connect} TLS:%{time_appconnect} Total:%{time_total}\n" https://<host>

# Test SSL/TLS
# openssl s_client -connect <host>:<port> -servername <host>

# Check listening ports
# ss -tlnp | grep <port>
# netstat -tlnp | grep <port>

Diagnostic Workflow

When debugging connectivity:

1. Identify endpoints: source and destination (IPs, ENIs, instances)
2. Check SGs: inbound on destination, outbound on source
3. Check NACLs: both inbound and outbound on both subnets
4. Check routes: does the route table have a path to the destination?
5. Check DNS: can the hostname resolve?
6. Check VPC endpoints: if accessing AWS services privately
7. Check flow logs: are packets being REJECTED?
8. Use Reachability Analyzer: for automated path analysis

Security Considerations for Network Diagnostics

Customers are responsible for configuring VPC Flow Logs, managing IAM policies for log access, encrypting log data with AWS KMS, and securing security group and NACL configurations. AWS is responsible for the underlying VPC and Amazon CloudWatch Logs service infrastructure.

• VPC Flow Logs may contain sensitive network topology information (IP addresses, ports, traffic patterns). Restrict access to flow log data using IAM policies and encrypt CloudWatch Log Groups with AWS KMS.
• Security group and NACL changes during troubleshooting can inadvertently expose resources. Document the original rules before making changes and revert after diagnosis.
• Diagnostic outputs (IP addresses, security group rules, route tables) should be treated as sensitive. Avoid sharing in unencrypted channels.