AWS EC2 network path inspection cheat sheet
Connect AWS identity, instance state, subnets, route tables, security groups and network ACLs in one inspection workflow.
AWS CLI v2 with an existing authenticated profile and read permissions for STS and EC2. Examples use eu-west-1.
Updated · AWS · 6 min read
| Command | What it does |
|---|---|
aws sts get-caller-identity --profile production --region eu-west-1 | Confirm the account and principal |
aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --profile production --region eu-west-1 | Inspect the target instance and interfaces |
aws ec2 describe-instance-status --instance-ids i-0123456789abcdef0 --include-all-instances --profile production --region eu-west-1 | Check instance and system status checks |
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-0123456789abcdef0 --profile production --region eu-west-1 | Identify the subnet route table and main fallback |
aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0 --profile production --region eu-west-1 | Inspect a security group attached to the interface |
aws ec2 describe-network-acls --filters Name=association.subnet-id,Values=subnet-0123456789abcdef0 --profile production --region eu-west-1 | Inspect the subnet network ACL |
Walkthrough
Replace the profile, region, instance, subnet, VPC and security-group IDs. Confirm the incident account first. AWS APIs return configuration; these commands do not run packet probes or change rules.
Step 1: Confirm the account and principal
aws sts get-caller-identity --profile production --region eu-west-1
Compare Account and Arn with the approved environment. A profile label does not prove account identity. Authentication failure must be resolved through the normal sign-in flow before interpreting missing resources as an infrastructure problem.
Step 2: Inspect the target instance and interfaces
aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --profile production --region eu-west-1
Record State, VpcId, SubnetId, private addresses and security groups on the actual network interface. A running instance can still have a failing guest OS or application. Wrong-region queries can look like missing resources.
Step 3: Check instance and system status checks
aws ec2 describe-instance-status --instance-ids i-0123456789abcdef0 --include-all-instances --profile production --region eu-west-1
Distinguish system status, instance status and any scheduled events. Passed checks do not establish application readiness, DNS correctness or allowed service ports; use them to separate infrastructure signals from later path checks.
Step 4: Identify the subnet route table and main fallback
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-0123456789abcdef0 --profile production --region eu-west-1
Find an explicit association for the instance subnet; otherwise use the VPC main route table. Inspect destination-specific routes, target and State, including blackhole entries. Listing only explicit subnet associations can miss the main-table fallback.
Step 5: Inspect a security group attached to the interface
aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0 --profile production --region eu-west-1
Compare protocol, ports and source or destination with the actual flow. Evaluate all groups attached to the interface because allowed rules combine. Security groups are stateful, but that does not override network ACLs, guest firewalls or missing routes.
Step 6: Inspect the subnet network ACL
aws ec2 describe-network-acls --filters Name=association.subnet-id,Values=subnet-0123456789abcdef0 --profile production --region eu-west-1
Evaluate the first matching rule in ascending rule-number order in each direction. ACLs are stateless, so include the response path and appropriate ephemeral ports. Confirm the effective client address when traffic passes through NAT or a load balancer.
WORKED INCIDENT
Practical case: An instance runs but HTTPS clients time out
Fictional teaching scenario; observations are examples, not captured production output.
Situation
An EC2 application is running, yet an approved client network cannot connect to TCP 443 after a subnet change.
Investigation sequence
1. Confirm the account and principal
aws sts get-caller-identity --profile production --region eu-west-1Record the account and principal to avoid examining a similarly named workload in another environment.
2. Inspect the target instance and interfaces
aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --profile production --region eu-west-1Identify the actual subnet and every security group attached to the serving interface.
3. Identify the subnet route table and main fallback
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-0123456789abcdef0 --profile production --region eu-west-1Resolve the effective subnet route table, including the main fallback, and trace the return destination.
4. Inspect a security group attached to the interface
aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0 --profile production --region eu-west-1Check inbound 443 against the real client source. In this example the security group permits it.
5. Inspect the subnet network ACL
aws ec2 describe-network-acls --filters Name=association.subnet-id,Values=subnet-0123456789abcdef0 --profile production --region eu-west-1Read ACL rules in order in both directions. The fictional example has an outbound rule denying the client ephemeral-port range before an allow rule.
Example findings
Illustrative findings: instance = running; security group permits inbound TCP 443; effective ACL has an earlier outbound deny matching response traffic.
Interpret the findings
The ACL is a supported path blocker in this example. It is not evidence that the application is healthy. Validate the client address and response ports against real flow evidence before changing a rule.
Verify the outcome
After the network owner applies a least-privilege correction, repeat configuration checks and perform an approved HTTPS request from the original client. Confirm application response and return traffic.
Escalation handoff
Provide account, region, ENI/subnet, effective route table, all attached groups, ordered ACL rules and client flow tuple. Escalate guest listener and host-firewall checks to the instance owner.