Requests through an ALB are producing more 5xx responses.
Determine whether the cause is a network rejection or a target response by matching source and time.
Which logs should be correlated first?
Correlate VPC Flow Logs with ALB access logs for the same time window.
Detailed explanation
Access Analyzer examines IAM access paths rather than individual network requests.
Access Analyzer examines IAM access paths rather than individual network requests.
Flow Logs show network ACCEPT or REJECT, while ALB logs show HTTP status and target details for the request.
Flow Logs show network ACCEPT or REJECT, while ALB logs show HTTP status and target details for the request.
Cache statistics cannot distinguish a rejected network flow from a target response at the ALB.
Cache statistics cannot distinguish a rejected network flow from a target response at the ALB.
Storage usage and DNS cache duration do not directly explain ALB network rejection or HTTP 5xx responses.
Storage usage and DNS cache duration do not directly explain ALB network rejection or HTTP 5xx responses.
Check official documentation
Compare the following points with the official documentation.
VPC Flow Logs and Application Load Balancer access logsの公式説明を確認する。
What to confirm
VPC Flow LogsとALB access logsで観測できる層の違いを説明できる。
Key points
- VPC Flow Logs
- ALB access logs
- ACCEPT/REJECT
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Layer correlation
Matching timestamps and source data links packet evidence to the corresponding HTTP request.
5xx scope
An ALB or target 5xx response is distinct from a flow rejected before the request reaches the load balancer.