MWAA Web Server Cannot Connect To my EC2 in another VPC but Schedulers and Worker can

Based on the information provided, it appears you're experiencing a connectivity issue between the Amazon Managed Workflows for Apache Airflow (MWAA) web server and an EC2 instance in another VPC, specifically on port 443. This is a complex issue, as the MWAA workers and schedulers can connect, but the web server cannot. Let's explore some potential solutions and areas to investigate:

1. VPC Peering Configuration: Although you've checked the VPC peering between the MWAA VPC and the target instance VPC, ensure that the route tables in both VPCs are correctly configured to route traffic through the peering connection. Double-check that the CIDR blocks for both VPCs are correctly listed in each other's route tables.

2. Security Groups and NACLs: While you've mentioned checking these, it's worth re-examining the security groups and network ACLs for both the MWAA environment and the target EC2 instance. Ensure that outbound rules in the MWAA security group allow traffic to the target instance's security group, and that inbound rules in the target instance's security group allow traffic from the MWAA security group, specifically on port 443.

3. MWAA Network Configuration: Check the MWAA environment's network configuration. Ensure that it's set up to use the correct VPC and subnets that have the necessary routing to reach the peered VPC.

4. NAT Gateway: If the MWAA web server is in a private subnet, ensure there's a properly configured NAT Gateway in the public subnet of the MWAA VPC. This is necessary for the web server to access the internet and potentially reach your target instance.

5. DNS Resolution: Although you've ruled out DNS issues by using the private IP address, ensure that DNS resolution is enabled for the VPC peering connection. This allows instances in either VPC to resolve private DNS hostnames of instances in the peered VPC to private IP addresses.

6. MWAA Web Server Specific Configuration: Since the issue is specific to the MWAA web server, there might be a configuration or networking setting unique to the web server component. Check if there are any MWAA-specific settings that could be affecting the web server's ability to connect to external resources.

7. CloudWatch Logs: Enable and check CloudWatch logs for the MWAA environment, focusing on the web server logs. Look for any error messages or connection timeouts that might provide more insight into the issue.

8. AWS Support: If you have AWS support, consider opening a support ticket. They may be able to provide more detailed insights into the MWAA networking configuration and potential issues.

9. Proxy Configuration: Check if there are any proxy settings in place for the MWAA environment that might be interfering with the web server's ability to connect directly to the target instance.

10. VPC Endpoints: If applicable, ensure that any necessary VPC endpoints are properly configured, especially if your target instance is providing services that typically use VPC endpoints (like S3 or DynamoDB).

Given the complexity of this issue and the fact that it's specific to the MWAA web server while other components are working, it may require deeper investigation into the MWAA service's networking architecture. Continue to monitor VPC flow logs and consider enabling more detailed logging for the MWAA environment to gather more information about the connection attempts from the web server.
Sources
Troubleshoot a VPC peering connection - Amazon Virtual Private Cloud
EC2 Connectivity problem on port 443 | AWS re:Post
Can't able to connect to the EC2 server in private network | AWS re:Post