VPC Reachability Analyzer · Static configuration analysis · Connectivity troubleshooting
Reachability Analyzer builds a model of the network configuration between a source and a destination and determines whether the destination is reachable. It sends no traffic. If the destination is reachable, it shows the hop-by-hop path; if not, it shows the blocking component and the reason.
The blocking point carries an explanation code such as ENI_SG_RULES_MISMATCH.
Static analysis that never touches the data plane
Source and destination resource types (+ destination IP address)
Analysis results are retained, then deleted automatically
Cross-account analysis across AWS Organizations at no extra charge
Why Reachability Analyzer
Connectivity problems arise where route tables, security groups, network ACLs, load balancers, and TGW routing overlap. Instead of opening console pages one by one, define a single path and run an analysis.
Because the verdict comes from configuration alone, you can check environments with no workloads yet as well as production environments, with no impact. Conversely, transient failures and packet loss are out of scope.
If the destination is not reachable, it returns the blocking component or combination of components along with an explanation code. If it is reachable, it lists the components along the path in order.
Because analyses can be run through the API, use them as a step in your deployment pipeline to confirm that intended paths were opened or closed.
How analysis works
A path consists of a source, a destination, a protocol, and a destination port. When you run an analysis, the result contains reachability, the forward and return path components, and the blocking reason. Below is a trimmed example result.
# Define the path: instance A → instance B, TCP 443
aws ec2 create-network-insights-path \
--source i-0a1b2c3d4e5f60001 --destination i-0a1b2c3d4e5f60002 \
--protocol tcp --destination-port 443
# Result after running the analysis
{
"Status": "succeeded",
"NetworkPathFound": false,
"Explanations": [{
"ExplanationCode": "ENI_SG_RULES_MISMATCH",
"Direction": "ingress",
"NetworkInterface": { "Id": "eni-0f..." },
"SecurityGroups": [{ "Id": "sg-0db..." }]
}]
}reachableIf there are several reachable paths, the shortest one is shown. To see other paths, run the analysis again including or excluding specific intermediate components.
not reachableCodes such as CANNOT_ROUTE, ENI_SG_RULES_MISMATCH, and FIREWALL_RULES_RESTRICTION indicate the type of cause. Other components may also be blocking, so analyze again after each fix.
When an intermediate component changes the header, as with IGW and NAT gateway address translation, it shows both the header leaving the source and the header arriving at the destination.
Features
Endpoints
Specify EC2 instances, network interfaces, internet gateways, transit gateways and their attachments, virtual private gateways, VPC endpoints and endpoint services, and VPC peering connections. An IP address can also be a destination.
Evaluated
Route tables, security groups, network ACLs, prefix lists, load balancers and target groups, NAT gateways, TGW route tables, VPN connections, and gateway endpoints are evaluated together along the path.
Network Firewall
Evaluates both stateless and stateful 5-tuple rules in Network Firewall. When it encounters unsupported rules such as domain lists, Suricata rules, rule options, or tag-based resource groups, it adds a notice to the path details. The analysis fails if a rule group references a resource group.
Filters
Narrow the analysis so the path must traverse or avoid a load balancer, NAT gateway, Network Firewall, transit gateway, or peering connection, and verify the exact path you intend.
Cross-account
With Organizations trusted access enabled, the management account or a delegated administrator account can specify resources in other member accounts as sources and destinations.
Automation
Save paths with CreateNetworkInsightsPath and StartNetworkInsightsAnalysis, then re-analyze the same path after every change.
Analysis covers IPv4 only. It analyzes paths within a single Region, either inside one VPC or between VPCs connected by peering or a transit gateway. It does not consider TGW Connect attachments, TGW policy tables, target health, BYOIP advertisement status, or Traffic Mirroring. TCP paths through TGW route tables are analyzed in the forward direction only, and paths through a GWLB endpoint do not include the GWLB and its targets.
Reachability vs Network Access
Both tools perform static analysis based on automated reasoning. Reachability Analyzer asks "can A reach B?", while Network Access Analyzer finds "paths that should not exist" as defined by a Network Access Scope.
| Item | Reachability Analyzer | Network Access Analyzer |
|---|---|---|
| Question | Can a specific source reach a specific destination? | Does any path matching the defined conditions exist anywhere in the network? |
| Input | Path: source, destination, protocol, port | Network Access Scope: paths to match and paths to exclude. Start from an Amazon-created scope, then copy and modify it |
| Output | Reachability, hop-by-hop path, explanation code | Findings: a set of representative paths that match the scope |
| Network Firewall rules | Evaluates 5-tuple rules | Rules are not evaluated. Paths the firewall blocks can still appear as findings |
| Account scope | Supports cross-account analysis with Organizations | Reports only paths within the analyzed account and Region |
| Typical use | Connectivity troubleshooting, path verification after changes | Compliance audits such as internet exposure checks, isolation between environments, and mandatory firewall inspection |
| Billing | Per analysis | Number of network interfaces analyzed |
Reference architecture
From the delegated administrator account, specify an instance in account A as the source and an instance in account B as the destination. The analysis follows the path through the Transit Gateway routing in the network account and reports where it is blocked by a security group in account B. For VPC configuration see the VPC page, and for hub routing see the Transit Gateway page.
On narrow screens, swipe the diagram sideways.
The management account can analyze resources in every account in the organization. A delegated administrator account can analyze member accounts other than the management account, plus management account resources explicitly shared with it. Complement it with VPC Flow Logs for actual traffic flows and Network Manager for global topology and route monitoring.
Getting started
Specify the source and destination resources, the protocol (TCP or UDP), and the destination port. Optionally add source/destination address and port range filters.
Save the path and start an analysis. If the path must traverse or avoid specific intermediate components, specify them now.
If reachable, review the hop-by-hop path; if blocked, check the explanation code and the blocking component.
After fixing routing or security groups, analyze the same path again. Any remaining blockers show up next.
For cross-account analysis, set up trusted access and a delegated administrator, and re-verify key paths through the API in your change pipeline.
Pricing
There is no standing charge; you pay only when you run an analysis. Unit prices are listed on the Network Analysis tab of the Amazon VPC pricing page.
| Billing item | Billed by | Notes |
|---|---|---|
| Reachability Analyzer | Per analysis between a source and a destination | Usage type Analysis-Runs. Re-analyzing the same path is billed again |
| Cross-account analysis | No additional charge | Analyses based on Organizations trusted access incur only the per-analysis charge |
| Network Access Analyzer | Number of network interfaces included in the analysis | Usage type NetworkInterface-Assessment. The broader the scope, the more ENIs are assessed |
Unit prices vary by Region. Check the latest prices on the Network Analysis tab of the Amazon VPC pricing page.
Next step
Bring a list of the paths you check during every incident, the paths that must stay open after changes, and the paths that must never open, and we will design your Reachability Analyzer and Network Access Analyzer setup together.