The ANS-C01 exam retires on December 31, 2026
You can still take and pass the exam until then — plan your exam date accordingly.
4.2.5. Reachability Analyzer
Reachability Analyzer provides a powerful tool for network specialists to quickly verify network reachability between resources and diagnose connectivity issues by simulating network paths.
Scenario: An application server in a private subnet cannot connect to a database server in another private subnet within the same VPC. You've checked Security Groups and NACLs but the issue persists.
For network specialists, diagnosing connectivity issues in complex AWS networks can be challenging due to multiple layers of network controls (Security Groups, NACLs, route tables, VPC peering, Transit Gateway).
Reachability Analyzer is a feature in Amazon VPC that analyzes the network path between two resources in your AWS network and determines if they are reachable. If they are not, it identifies the component that is blocking the path.
Key Features of Reachability Analyzer:
- Path Simulation: You specify a source and a destination (EC2 instance, Elastic Network Interface (ENI), load balancer, VPN gateway, Direct Connect Gateway, IP address).
- Connectivity Determination: It reports whether the resources are reachable and provides details of the network path if reachable.
- Root Cause Identification: If not reachable, it pinpoints the exact blocking component (e.g., a specific Security Group rule, a missing route table entry, a NACL rule).
- Supported Resources: Works across VPCs, VPC peering connections, Transit Gateways, VPNs, and Direct Connect connections.
- Proactive Analysis: Can be used to verify network configurations before deployment.
Choosing a Path-Analysis Tool:
| Tool | Answers | Typical use |
|---|---|---|
| Reachability Analyzer | Can this source reach this destination, and if not, which component blocks it? (configuration analysis; no packets sent; on demand or via API) | Diagnose one path; verify a change; scripted "golden path" checks; audit evidence for a named pair |
| Network Access Analyzer | Does any path exist that my Network Access Scope says should not? | Prove segmentation across many resources |
| Amazon Inspector network reachability | Which EC2 instances are reachable from outside the VPC, and on which ports? (automated, fleet-wide, recurring) | Continuous exposure checks without scheduling per-instance analyses |
| Network Manager Route Analyzer | Which route in the transit gateway route tables would traffic between two attachments follow? | Validate transit gateway routing |
| VPC Flow Logs | What traffic actually happened, and was it accepted or rejected? | Evidence of real traffic — not proof that a path does or does not exist |
Reachability Analyzer analyzes only AWS configuration: a path can end at an internet gateway, VPN gateway or transit gateway, but not at an on-premises device.
Practical Implementation: Using Reachability Analyzer (CLI)
# Assuming SOURCE_ENI_ID and DESTINATION_ENI_ID are defined
# 1. Create a network insights path
PATH_ID=$(aws ec2 create-network-insights-path \
--source-eni-id $SOURCE_ENI_ID \
--destination-eni-id $DESTINATION_ENI_ID \
--protocol tcp \
--destination-port 5432 \
--query NetworkInsightsPath.NetworkInsightsPathId --output text)
echo "Network Insights Path ID: $PATH_ID"
# 2. Start the network insights analysis
ANALYSIS_ID=$(aws ec2 start-network-insights-analysis \
--network-insights-path-id $PATH_ID \
--query NetworkInsightsAnalysis.NetworkInsightsAnalysisId --output text)
echo "Network Insights Analysis ID: $ANALYSIS_ID"
# 3. Describe the analysis results (wait for status to be "succeeded")
aws ec2 describe-network-insights-analyses --network-insights-analysis-ids $ANALYSIS_ID --query "NetworkInsightsAnalyses[0].Explanation"
⚠️ Common Pitfall: Not using Reachability Analyzer for complex connectivity issues. Manually tracing paths through multiple layers of network controls is error-prone and time-consuming.
Key Trade-Offs:
- Automated Analysis vs. Manual Effort: Reachability Analyzer automates complex path analysis, saving significant manual effort but requiring understanding of its output.
Reflection Question: How does Reachability Analyzer, by simulating network paths between resources and identifying the exact blocking component (e.g., Security Group rule, route table entry), fundamentally provide a powerful tool for you as a Network Specialist to quickly verify network reachability and diagnose complex connectivity issues?
