How do I analyze and troubleshoot my Amazon VPC network traffic flow?

Resolution

Use Reachability Analyzer to troubleshoot VPC connectivity issues

Use Amazon VPC Reachability Analyzer to check for issues with configurations for security groups, network access control lists (network ACLs), and route tables. You can also use Reachability Analyzer to analyze paths across multiple AWS accounts in your organization from AWS Organizations. For more information, see How Reachability Analyzer works.

Use VPC Flow Logs to monitor traffic

Use Amazon VPC Flow Logs to monitor traffic to and from your VPC, subnet, or elastic network interface. Analyze the data to understand traffic patterns and identify unexpected communication between resources. For more information, see Logging IP traffic using VPC Flow Logs.

Note: You can use the AWSSupport-EnableVPCFlowLogs runbook to activate Amazon VPC Flow Logs.

Use the Amazon EC2 console to identify unknown IP addresses

Use the Amazon Elastic Compute Cloud (Amazon EC2) console to find the resource that currently owns an unknown IP address in your Amazon VPC.