Networking and Content Delivery
Layered Network Connectivity and Content-Delivery Troubleshooting
CoreLocalize failures through DNS, request, flow, route, filter, endpoint, hybrid, cache, and live-performance evidence, then correct only the failing layer.
Aligned to AWS Certified CloudOps Engineer - Associate (SOA-C03) Version 1.1, verified August 24, 2026.
Why this matters
Connectivity symptoms look alike from the client. Effective troubleshooting distinguishes static configuration reachability, observed flow metadata, request-layer status, content cache behavior, tunnel routes, and live loss or latency.
Must Know
- VPC routing uses the most specific matching route. Trace the source subnet, every attachment or gateway, destination path, and return path before changing filters.
- Security groups automatically allow response traffic for an established allowed flow; NACLs are stateless and require allowed rules in both directions, including applicable ephemeral ports.
- VPC Flow Logs record IP-flow metadata and ACCEPT or REJECT decisions at an ENI, subnet, or VPC scope; they do not contain packet payloads or HTTP response bodies.
- Use ELB access logs for load-balancer requests, AWS WAF logs for web ACL evaluation, CloudFront logs for edge requests, and container/application logs for workload behavior.
- For stale or fragmented CloudFront content, inspect origin cache headers, TTLs, invalidations, and only the headers, cookies, and query strings that actually vary the representation.
- Reachability Analyzer evaluates a modeled configuration path without sending packets. CloudWatch Network Monitor and Internet Monitor provide live path or internet performance evidence such as availability, loss, or latency for supported scopes.
Compare and Distinguish
- A route table selects a target; SGs and NACLs filter; DNS supplies names. A change to one cannot repair a failure in another.
- Flow Logs expose network metadata; access logs expose request handling; application logs expose workload behavior.
- Reachability Analyzer evaluates configuration; Network Monitor and Internet Monitor observe live performance.
- A Site-to-Site VPN tunnel state shows tunnel availability, not that every advertised or static prefix and return path is correct.
Scenario examples
- Scenario: A route exists and SGs allow a request, but return traffic times out. Evaluate both NACL directions and the ephemeral return-port range.
- Scenario: An interface endpoint exists but clients use a public name. Verify VPC DNS settings, endpoint private DNS, endpoint subnets and security groups, policy, and Region.
- Scenario: CloudFront serves stale language variants. Include only the representation-varying request value in the cache key, set suitable TTLs, and invalidate only when required.
Exam traps
- Do not expect Flow Logs to contain packet bodies or HTTP status codes.
- Do not use Reachability Analyzer as a live latency monitor.
- Do not assume an UP VPN tunnel proves route exchange and return paths.
- Do not forward every header, cookie, and query string into the CloudFront cache key.
Key takeaways
- Follow evidence from name resolution to application response.
- Distinguish route, filter, and return-path failures.
- Use the log produced by the failing request layer.
- Validate live behavior after static-path analysis.
How it works
- Capture one failed and one successful request with time, source, destination, protocol, and request identifiers.
- Walk the configured path and correlate the log or monitor produced by each participating layer.
- Correct the first proven divergence and verify both static reachability and a live application request.
When to use it
- Inspect route tables to learn which target is selected, security groups and NACLs to find filtering decisions, and DNS to confirm name resolution; repair the layer whose evidence shows the failure.
- Choose VPC Flow Logs for network-flow metadata, access logs for request handling, and application logs for workload behavior.
- Use Reachability Analyzer to evaluate the configured path, then use CloudWatch Network Monitor or Internet Monitor when the question concerns live loss, latency, or availability.
- Treat an UP Site-to-Site VPN tunnel as tunnel-availability evidence only; verify advertised or static prefixes and the return path before concluding connectivity is healthy.
Security and governance implications
- Do not open security groups or NACLs broadly to test a theory; use logs and a narrowly scoped rule change.
- Protect packet-flow and request evidence because it can reveal internal topology, identities, and application behavior.
Failure signals and diagnosis
- Build a hop-by-hop path with source, destination, address family, port, route, attachment, and return route.
- Correlate timestamps and request or flow identifiers across DNS, edge, load balancer, WAF, flow, and application evidence.
- Change one proven failing layer, then verify both configuration analysis and a live request.
More detail
- Evaluate longest-prefix routing, stateful security groups, both NACL directions, and the return path independently.
- Use Flow Logs for network metadata and disposition, then choose edge, WAF, load-balancer, or application logs for request behavior.
- Include endpoint DNS, VPN prefixes, CloudFront cache keys, and live path evidence only when that layer is part of the symptom.
Ready for the quiz?
- A client times out even though a matching route exists. Which evidence reveals whether longest-prefix route selection, a security group, a NACL, or the return path is responsible?
- When does the investigation need Reachability Analyzer rather than a live Network Monitor or Internet Monitor signal?
- Which combination of Flow Logs, request logs, application logs, and live monitors identifies the first layer that changed a failing request?
Related objectives
- D5.3 — Task 5.3: Troubleshoot network connectivity issues.
- 5.3.1 — Troubleshoot VPC configurations (for example, subnets, route tables, network ACLs, security groups, transit gateways, NAT gateways).
- 5.3.2 — Collect and interpret networking logs to troubleshoot issues (for example, VPC flow logs, ELB access logs, AWS WAF web ACL logs, CloudFront logs, container logs).
- 5.3.3 — Identify and remediate CloudFront caching issues.
- 5.3.4 — Identify and troubleshoot hybrid connectivity issues and private connectivity issues.
- 5.3.5 — Configure and analyze CloudWatch network monitoring services.