A company has deployed a critical application on a fleet of Amazon EC2 instances behind an Application Load Balancer. The application must always be…

This solution correctly uses VPC Reachability Analyzer, a static analysis tool that verifies network path configurations without sending live traffic. It accurately models the required connectivity by defining a path from the internet gateway (representing the public internet) to the target EC2 instances on port 443. The automation workflow is robust: an Amazon EventBridge rule detects configuration changes to the security group via AWS CloudTrail API calls. This rule triggers a Lambda function, which initiates the Reachability Analyzer analysis. If the analysis shows the path is unreachable, the function publishes a notification to an SNS topic, alerting the network engineer as required.

A. VPC Flow Logs are reactive; they only report on traffic that has already been attempted and rejected. This does not meet the requirement to proactively verify connectivity immediately after a change.

B. This option shares the same reactive limitation as option A. Monitoring all traffic is inefficient and does not provide a direct, proactive check of the network path's configuration.

C. This option is technically invalid. A security group is a stateful firewall resource, not a network endpoint, and cannot be specified as a source in a VPC Reachability Analyzer path.

1. AWS Documentation: VPC Reachability Analyzer User Guide, "How Reachability Analyzer works." This document states, "Reachability Analyzer is a static configuration analysis tool... It does this without sending any packets on the network." This confirms its suitability for proactive checks.

2. AWS Documentation: VPC Reachability Analyzer User Guide, "Get started with Reachability Analyzer," Step 2: Create and analyze a path. This section lists the supported source and destination types. "Internet gateways" are listed as a valid source, while "Security groups" are not, confirming that option D is valid and option C is invalid.

3. AWS Documentation: Amazon EventBridge User Guide, "Creating a rule that reacts to an AWS event." This guide details how to create an EventBridge rule that triggers on specific AWS API calls, such as AuthorizeSecurityGroupIngress or RevokeSecurityGroupIngress, which are logged by AWS CloudTrail when a security group is modified.

4. AWS Documentation: AWS Lambda Developer Guide, "Using AWS Lambda with Amazon EventBridge (CloudWatch Events)." This document explains how EventBridge can invoke a Lambda function in response to an event, forming the core of the required automation.