Network Reachability: Reachability Analyzer and VPC Flow Logs

Sign in, start the endpoints and set names:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
.\Start-SsmEndpoints.ps1

1Build an app-to-database path

Paste this whole block. db58 runs a small web service on port 8080 that app58 calls:

$dbSg = aws ec2 create-security-group --group-name saat-db58-sg --description "db58 port 8080 from app tier" --vpc-id $v.VpcId --query GroupId --output text
aws ec2 authorize-security-group-ingress --group-id $dbSg --ip-permissions "IpProtocol=tcp,FromPort=8080,ToPort=8080,UserIdGroupPairs=[{GroupId=$($v.AppSg),Description=8080-from-app}]" | Out-Null
$ami = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$app = aws ec2 run-instances --image-id $ami --instance-type t3.micro --subnet-id $v.PrivateA --security-group-ids $v.AppSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=app58},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=58}]' --query "Instances[0].InstanceId" --output text
$db = aws ec2 run-instances --image-id $ami --instance-type t3.micro --subnet-id $v.PrivateB --security-group-ids $dbSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --user-data "#!/bin/bash
systemd-run --unit=web8080 python3 -m http.server 8080 --directory /tmp" --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=db58},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=58}]' --query "Instances[0].InstanceId" --output text
foreach ($x in $app, $db) { do { Start-Sleep 20; $p = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$x" --query "InstanceInformationList[0].PingStatus" --output text } until ($p -eq 'Online') }
$dbIp = aws ec2 describe-instances --instance-ids $db --query "Reservations[0].Instances[0].PrivateIpAddress" --output text
function Invoke-Linux([string]$Id, [string[]]$Lines) {
  @{ commands = $Lines } | ConvertTo-Json | Set-Content lx-cmd.json
  $cmd = aws ssm send-command --document-name AWS-RunShellScript --instance-ids $Id --parameters file://lx-cmd.json --query Command.CommandId --output text
  do { Start-Sleep 5; $st = aws ssm get-command-invocation --command-id $cmd --instance-id $Id --query Status --output text 2>$null } until ($st -in 'Success', 'Failed', 'TimedOut')
  aws ssm get-command-invocation --command-id $cmd --instance-id $Id --query StandardOutputContent --output text
}
function Test-App { Invoke-Linux $app @(('curl -s -o /dev/null -w "%{http_code}\n" --max-time 5 http://' + $dbIp + ':8080/; echo "curl exit $?"')) }
Test-App

You should see something like this:

200
curl exit 0

app58 in saat-private-a reaches db58 in saat-private-b on port 8080. This is the “it worked yesterday” baseline.

2Turn on VPC Flow Logs and query them

Paste this whole block. Flow records take up to about 10 minutes to arrive, so it makes traffic, then waits:

aws logs create-log-group --log-group-name /saat/vpc-flow
aws logs put-retention-policy --log-group-name /saat/vpc-flow --retention-in-days 1
'{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "vpc-flow-logs.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }' | Set-Content fl-trust.json
'{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams"], "Resource": "*" } ] }' | Set-Content fl-policy.json
$flRole = aws iam create-role --role-name saat-flowlogs-role --assume-role-policy-document file://fl-trust.json --query Role.Arn --output text
aws iam put-role-policy --role-name saat-flowlogs-role --policy-name write-logs --policy-document file://fl-policy.json
Start-Sleep 15
$fl = aws ec2 create-flow-logs --resource-type VPC --resource-ids $v.VpcId --traffic-type ALL --log-destination-type cloud-watch-logs --log-group-name /saat/vpc-flow --deliver-logs-permission-arn $flRole --max-aggregation-interval 60 --query "FlowLogIds[0]" --output text
1..5 | ForEach-Object { Test-App | Out-Null }
Start-Sleep 600
function Get-Flows([int]$Port, [int]$Minutes = 15) {
  $e = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds(); $s = $e - $Minutes * 60
  $q = "fields srcAddr, dstAddr, dstPort, action | filter dstPort = $Port | stats count(*) as flows by srcAddr, dstAddr, action"
  $qid = aws logs start-query --log-group-name /saat/vpc-flow --start-time $s --end-time $e --query-string $q --query queryId --output text
  do { Start-Sleep 3; $r = aws logs get-query-results --query-id $qid | ConvertFrom-Json } until ($r.status -in 'Complete', 'Failed', 'Cancelled')
  $r.results | ForEach-Object { $h = @{}; $_ | ForEach-Object { $h[$_.field] = $_.value }; '{0,-14} -> {1,-14} {2,-7} {3}' -f $h.srcAddr, $h.dstAddr, $h.action, $h.flows }
}
Get-Flows 8080

You should see something like this:

10.20.11.37    -> 10.20.12.84    ACCEPT  6

Each line is one source, destination and action, with the number of flow records. app58’s calls to db58 on 8080 were accepted.

3Ask Reachability Analyzer

Paste this whole block:

$path = aws ec2 create-network-insights-path --source $app --destination $db --protocol tcp --destination-port 8080 --tag-specifications 'ResourceType=network-insights-path,Tags=[{Key=Name,Value=app58-to-db58},{Key=course,Value=saatvedha-aws}]' --query NetworkInsightsPath.NetworkInsightsPathId --output text
function Test-Reach {
  $a = aws ec2 start-network-insights-analysis --network-insights-path-id $path --query NetworkInsightsAnalysis.NetworkInsightsAnalysisId --output text
  do { Start-Sleep 10; $st = aws ec2 describe-network-insights-analyses --network-insights-analysis-ids $a --query "NetworkInsightsAnalyses[0].Status" --output text } until ($st -ne 'running')
  aws ec2 describe-network-insights-analyses --network-insights-analysis-ids $a --query "NetworkInsightsAnalyses[0].[NetworkPathFound,Explanations[0].ExplanationCode,Explanations[0].SecurityGroup.Id]" --output text
}
Test-Reach

You should see something like this:

True    None    None

The configuration allows the path, and the flow logs show it being used. In the console, open VPC > Reachability Analyzer and the analysis to see the hop-by-hop path: ENI, security groups, route table, NACLs, target ENI.

✅ Checkpoint: curl returns 200, Get-Flows shows ACCEPT flows to 10.x.x.x on 8080, and Test-Reach returns True.