Three tools that answer 'why can't this reach that'

Speaker notes

• VPC Reachability Analyzer performs configuration analysis (not live traffic testing) between a specific source and destination: when the path is reachable, it shows the hop-by-hop route through every component (route table, Security Group, NACL); when it's blocked, it identifies exactly which component is blocking it, turning a manual multi-tool debugging session into a single automated answer.
• Network Access Analyzer works in the opposite direction: instead of testing one specific path, you define a scope (a security or compliance intent, like 'every path from my web tier to the internet must traverse the firewall') and it scans your entire network configuration to find any path that violates that intent, the mechanism behind proactively catching an accidental firewall bypass before an audit or an incident does.
• Traffic Mirroring copies actual network traffic from an ENI to a monitoring target (an intrusion detection appliance, a packet analyzer) for deep inspection of real packets, not just configuration. One documented limitation worth remembering: Network Access Analyzer's path analysis does not account for Traffic Mirroring, mirrored traffic doesn't show up as a connectivity path in its results, since the two tools solve genuinely different problems (configuration analysis vs. live packet capture).

Deck map