Getting started with VPC Reachability Analyzer - Amazon Virtual Private Cloud

Getting started with VPC Reachability Analyzer

You can use VPC Reachability Analyzer to determine whether a destination resource in your virtual private cloud (VPC) is reachable from a source resource. To get started, you specify a source and a destination. For example, you can run a reachability analysis between two network interfaces or between a network interface and a gateway. If there is a reachable path between the source and destination, Reachability Analyzer displays the details. Otherwise, Reachability Analyzer identifies the blocking component.

Before you begin

Verify that your source and destination resources meet the following requirements.

  • The following resources types are supported as sources and destinations:

    • Instances

    • Internet gateways

    • Network interfaces

    • Transit gateways

    • VPC endpoints

    • VPC peering connections

    • VPN gateways

  • The source and destination resources must be owned by the same AWS account.

  • The source and destination resources must be in the same Region.

  • The source and destination resources must be in the same VPC or in VPCs that are connected through a VPC peering connection. In the case of a shared VPC, the resources must be owned by the same AWS account.

Step 1: Create and analyze a path

Specify the path for the traffic from a source to a destination. After you create the path, Reachability Analyzer analyzes the path once. You can analyze a path at any time to determine whether your intended connectivity is supported, even as your network configuration changes.

To create a path

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. In the navigation pane, choose Reachability Analyzer.

  3. Choose Create and analyze path.

  4. (Optional) For Name tag, enter a descriptive name for the analysis.

  5. To specify the source resource, choose the resource type from Source type, and then choose the specific resource from Source.

    For components that support multiple IP addresses, such as instances, you can optionally enter a private IP address for Source IP address. By default, Reachability Analyzer considers all IP addresses.

  6. To specify the destination resource, choose the resource type from Destination type, and then choose the specific resource from Destination.

    For components that support multiple IP addresses, such as instances, you can optionally enter a private IP address for Destination IP address. By default, Reachability Analyzer considers all IP addresses.

  7. (Optional) Enter the port number for Destination port. By default, Reachability Analyzer considers all ports.

  8. For Protocol, choose TCP or UDP.

  9. (Optional) To add a tag, choose Add new tag and then enter the tag key and tag value.

  10. Choose Create and analyze path.

Step 2: View the results of the path analysis

After the path analysis completes, you can view the results.

To view the results of a path analysis

  1. Choose the ID of the path in the Path ID column to view the path details page.

  2. In the Analysis explorer panel, find Reachability status and check whether it is Reachable or Not reachable. If the path is reachable, the console displays the shortest route found between the source and destination. Otherwise, expand Explanations, Details for information about the blocking component.

  3. If the reachability status matches your intent, there is no further action required. Consider running the analysis again if you change your network configuration so that you can ensure that the reachability status still matches your intent. Otherwise, proceed to Step 3.

Step 3: Change the network configuration and analyze the path

If the reachability status does not match your intent, you can change your network configuration. Then you can analyze the path again to confirm that the reachability status matches your intent.

To restore connectivity for a path that is not reachable

  1. The Analysis explorer panel includes an explanation code and detailed information about the component or combination of components that is blocking the path (under Explanations, Details). For example, in the following explanation, the security group shown does not have an inbound rule that allows the traffic to reach the destination EC2 instance:

    
      Example explanation details
  2. Update the configuration of the component so that the desired traffic can traverse the component.

  3. Choose Analyze path to confirm that the path is now reachable. You can optionally specify the Amazon Resource Name (ARN) of a resource that the path must traverse. The following are supported as intermediate components: load balancers, NAT gateways, and VPC peering connections.

To remove connectivity for a reachable path

  1. The Analysis explorer panel includes a visual representation of the shortest route found between the source and destination. It includes all components between the source and destination. For example, the following diagram shows the components that traffic traverses from the source EC2 instance to the destination internet gateway:

    
      Example visual representation of a reachable path
  2. Identify the component that is overly permissive and update its configuration.

  3. Choose Analyze path to confirm that the path is no longer reachable.