Calls from a private subnet to an external API have become slow.
Before changing the design, determine whether NAT capacity or port pressure is involved.
Which investigation is most appropriate?
Combine NAT Gateway CloudWatch metrics with VPC Flow Logs to inspect load, connections, and rejected flows.
Detailed explanation
Domain fees do not represent NAT processing volume or connection state.
Domain fees do not represent NAT processing volume or connection state.
Password policy changes do not improve NAT capacity or network connections.
Password policy changes do not improve NAT capacity or network connections.
NAT bytes, packets, and connections show load, while flow records show rejected or delayed paths.
NAT bytes, packets, and connections show load, while flow records show rejected or delayed paths.
S3 access logs do not observe the private subnet's NAT path.
S3 access logs do not observe the private subnet's NAT path.
Check official documentation
Compare the following points with the official documentation.
NAT Gateway CloudWatch metrics and VPC Flow Logsの公式説明を確認する。
What to confirm
メトリクスとフローログを使ったネットワーク障害の観測手順を説明できる。
Key points
- NAT Gateway metrics
- VPC Flow Logs
- Connection count
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Capacity evidence
NAT metrics reveal load and connection pressure before a topology change is selected.
Path evidence
Flow records show whether traffic is rejected on the route in addition to showing service load.