Two instances in the same VPC cannot connect on the application port. VPC Reachability Analyzer reports that the path is blocked by a security group. What should the operator do next?
Select an answer to reveal the explanation.
Short Explanation
The analyzer already walked the path and marked the locked door. You change the security group it named, then you run the analysis again to see whether the path is clear. Rebuilding route tables guesses at a problem the report did not find.
Full Explanation
VPC Reachability Analyzer walks the path you specify and names the component that drops the traffic, including a route table, a security group, or a network ACL. This report says a security group blocks the path, so the next change is that group. After the group allows the flow, run the analysis again to confirm the path or to expose the next block. Replacing the route tables treats the finding as a missing route. The analyzer reports the component it actually found, and a route problem would be named as a route. A peering connection joins two VPCs. These instances are already in the same VPC, and a peering link does not repair a security group. The source/destination check matters on an instance that forwards traffic it did not originate. Clearing it does not open a security group, and ignoring the analyzer throws away the evidence in hand. Caveat: change the group, direction, and peer the finding names, because a wide-open edit can hide which rule was missing. Operational check: rerun the analysis for the same endpoints and port, and confirm the path is reachable or that the report now names a different component.