A VPC is an isolated network within an AWS region, subdivided into subnets pinned to individual Availability Zones. Most VPC troubleshooting is tracing a packet's path through route tables, security groups and NACLs.
VPCs & Subnets
aws ec2 describe-vpcsLists VPCs in the current region.
aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-0123456789abcdef0"Lists subnets belonging to a specific VPC.
aws ec2 create-subnet --vpc-id vpc-0123456789abcdef0 --cidr-block 10.0.1.0/24 --availability-zone us-east-1aCreates a subnet within a VPC's address space, pinned to one AZ.
Route Tables
aws ec2 describe-route-tablesLists route tables and the routes/subnet associations for each — the first place to check when traffic isn't reaching where it should.
aws ec2 create-route --route-table-id rtb-0123456789abcdef0 --destination-cidr-block 0.0.0.0/0 --gateway-id igw-0123456789abcdef0Adds a default route to an internet gateway — what makes a subnet 'public.'
Public vs. private subnet
There's no subnet-level flag for "public" — it's purely a consequence of its route table having a route to an Internet Gateway (public) versus only a route to a NAT Gateway or nothing external at all (private).
Internet & NAT Gateways
aws ec2 describe-internet-gatewaysLists internet gateways and which VPC each is attached to.
aws ec2 describe-nat-gatewaysLists NAT gateways — how a private subnet gets outbound-only internet access without being directly reachable from it.
Security Groups & NACLs
aws ec2 describe-network-aclsLists Network ACLs — stateless, subnet-level allow/deny rules evaluated before a security group's stateful rules.
Security Group
Stateful, attached to individual ENIs/instances. Only allow rules — no explicit deny. Return traffic for an allowed connection is automatically permitted.
Network ACL
Stateless, attached to a subnet. Supports explicit allow and deny rules, evaluated in numbered order. Return traffic needs its own explicit rule — an easy thing to forget when locking one down.
VPC Peering & Endpoints
aws ec2 describe-vpc-peering-connectionsLists peering connections between VPCs and their status.
aws ec2 describe-vpc-endpointsLists VPC endpoints — private connectivity to an AWS service (like S3 or DynamoDB) without traffic leaving the AWS network via a NAT Gateway or internet gateway at all.
Connectivity Diagnostics
aws ec2 describe-network-interfaces --filters Name=private-ip-address,Values=10.0.1.15Finds which ENI (and therefore which instance or service) owns a given private IP — useful when tracing where traffic is actually going.
Reachability Analyzer (aws ec2 create-network-insights-path + start-network-insights-analysis) traces the exact
hop-by-hop path — and the specific blocking rule — between two resources without you manually walking route tables
and security groups by hand.