Home / AWS

AWSHow-toBeginner

Two AWS resources can't talk: security groups, NACLs, routes and Reachability Analyzer

Prove where a connection breaks between instances, subnets, peered VPCs or Transit Gateway attachments, using Reachability Analyzer and VPC Flow Logs instead of guesswork.

Deepak Bhardwaj2 min read

Applies toAmazon VPC, VPC peering, Transit Gateway, EC2 and ENI-based services

Security groups vs network ACLs

Security group Network ACL
Applies to ENI (instance, RDS, endpoint...) Subnet
State Stateful: replies allowed automatically Stateless: needs explicit return rules
Rules Allow only Allow and deny, evaluated by rule number
Typical mistake Source set to the wrong SG or CIDR No outbound rule for ephemeral ports 1024–65535

1. Ask Reachability Analyzer

PATH_ID=$(aws ec2 create-network-insights-path --source i-0app --destination i-0db \
  --protocol tcp --destination-port 5432 --query "NetworkInsightsPath.NetworkInsightsPathId" --output text)
AN_ID=$(aws ec2 start-network-insights-analysis --network-insights-path-id $PATH_ID \
  --query "NetworkInsightsAnalysis.NetworkInsightsAnalysisId" --output text)
aws ec2 describe-network-insights-analyses --network-insights-analysis-ids $AN_ID \
  --query "NetworkInsightsAnalyses[].{reachable:NetworkPathFound,explanations:Explanations[].ExplanationCode}"

If the path isn't reachable, the explanation codes name the blocking component (for example ENI_SG_RULES_MISMATCH or NO_ROUTE_TO_DESTINATION) and its ID. It works across peering, Transit Gateway and load balancers, without sending any traffic.

2. Confirm with Flow Logs

aws ec2 create-flow-logs --resource-type ENI --resource-ids eni-0db --traffic-type ALL \
  --log-destination-type cloud-watch-logs --log-group-name /vpc/flow/db --deliver-logs-permission-arn arn:aws:iam::111122223333:role/flowlogs

In Logs Insights:

fields @timestamp, srcAddr, dstAddr, dstPort, action
| filter dstPort = 5432
| sort @timestamp desc | limit 50
  • REJECT on the destination ENI → its security group or the subnet NACL.
  • ACCEPT inbound but the client still times out → the return path: NACL outbound, routes, or the host firewall.
  • No records at all → the traffic never reaches that ENI. Check routes, peering, TGW route tables and DNS.

3. Common causes

  • Peering: both VPC route tables need routes to each other's CIDR. Peering isn't transitive, and overlapping CIDRs can't be peered.
  • Transit Gateway: the attachment must be associated with a TGW route table and propagated into the destination's table, and the VPC subnet route table needs a route to the TGW.
  • Security group referencing: referencing a peer VPC's security group needs same-region peering. Across regions, use CIDRs.
  • Host firewall: firewalld/iptables or Windows Firewall on the target. AWS tools can't see these.
  • Wrong DNS answer: the client connects to a public IP instead of the private one.

Tip

Save the Reachability Analyzer path for critical flows (app → DB, app → API) and re-run it after every network change as a regression test.

Related fixes