- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud
Troubleshoot Workload Reachability in AWS
Practice the diagnostic loop an AWS infrastructure engineer runs when an application endpoint stops responding even though its servers report healthy. You'll start from a customer portal that times out after an overnight network hardening change, establish the expected access path through the Application Load Balancer, the frontend servers and the customer-data service they depend on, and test it in order from name resolution through the load balancer, target health, security groups, network ACLs and route tables. You'll isolate the breaks with VPC Flow Logs evidence read by connection and direction, reasoning about which sender each rule trusts and how stateless rules treat return traffic, apply the smallest configuration changes that restore the path, prove the same path works again from your browser, and record the incident on a CloudWatch dashboard for the team's runbook. You'll work entirely in the AWS Management Console. When you finish, you'll be able to walk a reachability failure hop by hop and connection by connection, name the failing control from evidence, fix it with the minimum change, prove the fix on the same path, and leave a record your team can act on.
Lab Info
Table of Contents
-
Challenge
Establish the expected access path and confirm the failure
Read the portal's intended access path through the load balancer, frontend servers, and customer-data service. Confirm the browser timeout and name-resolution result, then compare the failure with the healthy frontend targets.
-
Challenge
Trace the path from name resolution to the route table
Trace each connection from name resolution through the load balancer, target health, security groups, network ACLs, and route tables. Compare the sender and return direction with the configured rules, identify the suspect hops, and copy the IDs needed for the evidence queries and incident record.
-
Challenge
Isolate the failing elements with configuration and log evidence
Run the supplied VPC Flow Logs queries in CloudWatch Log Analytics. Combine the request and response records with the configuration evidence to identify the two failing network controls.
-
Challenge
Apply the minimum changes to restore the path
Apply the smallest configuration change to each failing control. Restore the browser's return path first, then correct the customer-data service's trusted source.
-
Challenge
Re-test the original path and confirm the expected response
Re-test the original portal URL from the same browser and confirm the expected customer data and healthy targets. Verify both traffic transitions in fresh flow log evidence and add the query results to a CloudWatch hand-off dashboard.
-
Challenge
Record the failure points, the changes, and the verification result
Create an incident record on the CloudWatch hand-off dashboard that identifies the failure points, changes, and verification result. Use CloudTrail Event history as supporting confirmation of the two changes.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.