Instructor: Okay, so let's play
with VPC Reachability analyzer
to understand how things work.
So just so you know, as of this time,
so if you look at reachability analyzer pricing,
there is a 10 cents analysis every time you run one.
So let me just show you, here we go.
So the Amazon VPC whichever the two analyzer
is costing 10 cents per analysis.
And the goal is for you not to run analysis all the time
this is why they have a small cost on it.
So just so you know,
if you go ahead and run some rules with me
as some analysis, that is going
to cost you a little bit of money.
So let's create an analyze a path.
And so here I need to enable a source and a destination.
So the source could be any of these things.
So it could be an instance, transit gateway,
internet gateway, VPC endpoints.
All of these kind of things can be
sources so let's use an instance and then I will choose,
for example, my BastionHost.
Okay and we can optionally specify the source IP address,
but as you can see, I don't need to because, well,
the two instance has a source IP address.
And then for destination, again,
instance, I will choose my private instance.
And we're good to go.
We can also specify a destination port.
So to evaluate whether or not a port is accessible.
An electric access port 80, port 443.
Okay, on my private instance, using the TCP protocol.
So let's create an analyze this path.
Now the requests and analysis was succeeded.
And remember, this does not actually sends it network data,
it just analyzes the path, okay.
And this analysis, let me refresh it.
So it has pending and it turns out that it's not reachable.
So how do we know it?
Well, we are going to click on this analysis right here.
I'm going to click on it.
And then there is the analysis explorer
and there are the explanations.
And it turns out that there is an ENI
as your rules mismatch.
And so this is telling you where there is a problem.
So it turns out that's none of the English rules
in the following security group apply.
So that means that we haven't enabled 443
on my security group.
So if I go into my security group in here and look at it
in DDS, there's only SSH on port 22.
There's no HTTPS.
So I could indeed edit the rules at a rule
and then have HTTPS and then from anywhere
and then save rules and here we go.
So now if I go again in this and want
to rerun this analysis,
so what I can do is I can do analyze the path, yet again.
And confirm.
It's going to launch a second analysis okay.
Which has pending and it turns out that
now my instance is reachable.
So this is good.
This is fixed and we can have a look at the path.
So this is all the things you went through.
So this instance to an ENI to a security group
to a network SEL to a network SEL
to a security groups in ENI to the institute instance
and we can have a look at the reverse path as well, okay.
So let's do another little scenario.
So let's go into RVPC.
I'm going to go into my Network ACLs
and I'm going to edit a rule.
So for example, I'm going to, in my default NACL,
I'm going to change some inbound rules, okay.
And I'm going to say, that's all traffic on HTTPS.
So and then you have this here on rule number 80
is going to be denied.
So we're going deny the HTTPS explicitly.
And again, what we're going to do is run this analyzer.
And again, this cost me 10 cents every time I do it.
So I'm doing it because I have a big budget for this course,
but obviously I'd be careful as you're doing it on your own.
Okay.
And so again,
this is pending and let's have a look at the analysis
and now we are in not reachable space.
And if you look at the analysis itself,
it says the destination is not reachable.
And the network ACL does not allow inbound traffic
from the subnets to VPC.
See this.
And so, again, it knows the network ACL
that is not working.
And so therefore what I have to do is just, again,
change the inbound rules, edit them.
And then obviously we need to remove this rule
to make it work, okay.
But this is really cool because all of these kind
of like analysis to make sure that your instance
is going to be accessible and stuff, you know,
you have a really, really powerful tool here
with a reachability analyzer to understand
why it's happening.
And especially if your network topology
becomes very complex.
As we learn about NAT gateways, internet gateways,
egress only gateways, transit gateways,
all of these kinds of things.
It can be very complicated to debug.
And this is a very handy tool from AWS
to have a look at this, okay.
So that's it, I hope you liked it.
And I will see you in the next lecture.