AWS Reachability Analyzer

The tool analyzes AWS network reachability by modeling core networking components (VPCs, subnets, route tables, NACLs, security groups, VGWs, and VPC endpoints) to determine whether a path exists between a defined source and destination for a specified protocol and port. It accepts resource identifiers, region context, and optional constraints to set the evaluation scope, and returns an explicit reachability verdict with a path overview.
Conceptually resources are nodes and network rules are edges. The engine evaluates current configurations and traverses allowed edges to compute a valid path, reporting the hops involved, and highlighting blockers such as overly restrictive SG rules, missing routes, or conflicting NACL entries. Results include a traceable path diagram in text form for auditability.
Target users include cloud architects, network engineers, SREs, DevOps teams, and security practitioners who plan migrations, troubleshoot cross-resource connectivity, or validate changes before deployment. It supports cross-account contexts and multi-region topologies, reflecting realistic enterprise environments and enabling faster decision making, less guesswork, and improved change control.
Core value lies in deterministic, auditable results with actionable remediation guidance. It provides reproducible analyses, exportable reports, and integration-ready outputs that feed into change management and security reviews. Use cases include validating application reachability after security policy updates, during VPC peering changes, or when evaluating hybrid connectivity in AWS.