Network Management and Operation
Core concepts
Operations covers visibility, troubleshooting, and change management. Know VPC Flow Logs (accepted/rejected traffic, aggregation intervals, destinations: CloudWatch Logs, S3, Firehose), Traffic Mirroring for packet capture, Reachability Analyzer for path analysis, and Network Access Analyzer for unintended access. Understand CloudWatch metrics for NAT Gateway, Transit Gateway, VPN, and Direct Connect, plus Route 53 Resolver query logs. Familiarize yourself with AWS Network Manager and Transit Gateway Network Manager for global topology and on-premises visibility.
Traps
Flow Logs do not capture packet payloads, and they do not log traffic to the Amazon DNS server or DHCP, or traffic between an instance and the instance metadata service. A rejected flow log entry may be caused by a security group, NACL, or missing route; do not assume it is only one. Reachability Analyzer needs the exact source and destination (ENI, IP, or load balancer) and a path that exists in configuration; it cannot see host firewalls. Also watch for log destination permissions: the IAM role must allow delivery to the chosen target.
Rule of thumb
Triage from broad to narrow: check routes, then security groups, then NACLs, then host firewall. Use Reachability Analyzer before packet capture, and Flow Logs to confirm whether traffic reached the ENI at all.
Worked example
An instance cannot reach an S3 gateway endpoint. Flow Logs show rejected traffic from the instance. The route table lacks the endpoint prefix list route, and the endpoint policy denies the bucket. Fix the route and policy, then re-run Reachability Analyzer to confirm.