Lecture 49: VPC features for Network Analysis
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：02:36
- 来源：Udemy Lecture 41577732
- Slide 数量：2
- 画面切换：00:37
扫描说明
逐条检查了 Udemy 页面中的 50 条 Transcript cue，并对全长 02:36 的视频画面进行扫描。画面在 00:37 左右从 VPC 网络分析标题页切换到两项分析服务的对比图，共识别出 2 张不同的 Slide。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Network Analysis 概览
时间范围：00:00–00:37
总结 / Summary
中文
AWS 的 VPC 网络分析（VPC Network Analysis）能力用于加速连接故障排除，并验证网络路径是否符合安全策略。本讲先从高层区分 VPC 可达性分析器（VPC Reachability Analyzer）和网络访问分析器（Network Access Analyzer）。
English
AWS VPC Network Analysis capabilities accelerate connectivity troubleshooting and verify whether network paths comply with security policies. This introduction distinguishes VPC Reachability Analyzer from Network Access Analyzer at a high level.
Transcript
00:00 Hi.
00:01 So in this section,
00:02 we have already seen a couple of ways in which you can troubleshoot
00:05 the network traffic issues and how to monitor your VPC traffic.
00:10 But AWS now also provides different ways to analyze the network traffic.
00:15 And it basically helps you accelerate your troubleshooting issues or making
00:20 sure that your network traffic is compliant to your security policies.
00:24 So in this space at this moment, there are two tools that
00:28 AWS provides
00:29 and I think it will be beneficial if you
00:30 just understand at high level how these tools work.
00:33 So this comes under VPC
00:35 network analysis and natively
2. Reachability Analyzer 与 Network Access Analyzer
时间范围：00:37–02:36
总结 / Summary
中文
VPC 可达性分析器（VPC Reachability Analyzer）回答“指定源能否到达指定目的地”，并沿途评估路由、互联网网关（Internet Gateway）、NACL、安全组（Security Group）和 VPC 对等连接（VPC Peering）等组件，适合定位具体连接失败。网络访问分析器（Network Access Analyzer）则枚举源与目的地之间可能存在的路径，并依据安全策略判断路径是否合规，例如验证流量必须经过防火墙、指定 EC2 实例或 NAT 网关（NAT Gateway），以及发现意外的互联网路径。
English
VPC Reachability Analyzer answers whether a specified source can reach a specified destination by evaluating components such as routes, Internet Gateways, NACLs, Security Groups, and VPC Peering along the path, making it useful for a particular connectivity failure. Network Access Analyzer instead discovers possible paths between sources and destinations and evaluates them against security policies, such as requiring traffic to traverse a firewall, designated EC2 instance, or NAT Gateway and detecting an unintended internet path.
Transcript
00:37 AWS provides two ways.
00:39 First reachability analyzer and second network access analyzer.
00:43 Now, what's the difference between two?
00:45 So reachability analyzer will tell you if you
00:48 provide the source and the destination of the traffic,
00:51 can you reach to the destination from your source?
00:54 So in that hop, there could be internet Gateway,
00:57 there could be Network-Access-Control-List security groups, VPC
01:01 peering connections,
01:02 all these things.
01:03 So at the end of your analysis,
01:05 it will tell you whether you can reach to the destination from your source.
01:09 So this is very helpful in use cases,
01:11 something like you are not able to reach to a particular EC2 instance
01:15 in another VPC or from your workstation to your EC2 machine over SSH,
01:21 right. So for this kind of connectivity issues, you can use reachability analyzer.
01:26 Now the second tool is network access analyzer.
01:29 Now this also works in a similar fashion. But the difference is that here
01:33 you are trying to analyze which all paths exist to go from source to the destination.
01:39 And whether those paths are as per the
01:41 security policies that you have for an example,
01:44 if there is a source
01:46 and there is a destination as two different EC2 machines in different VPCs.
01:50 And you want to make sure that all the traffic goes through your Firewall
01:54 or through a particular EC2 instance or through a NAT Gateway. For example.
01:59 Now, in that case, you can use network access analyzer
02:01 and it will tell you
02:03 which all paths exist between the source or destination.
02:06 And then you can see, OK,
02:08 I see that this path is going over the internet, which I did not want.
02:12 So you can mark that path as a non compliant and then you can modify your routes.
02:16 So that next time you scan your network network access
02:20 analyzer shows you that this path now doesn't exist.
02:23 So basically network access analyzer is used to make sure that
02:27 you have the compliant network.
02:29 So that is at high level, these two services provide.
02:32 And now let's talk about these individual services.
整讲总结 / Overall Summary
中文
两项服务解决不同问题：VPC 可达性分析器（VPC Reachability Analyzer）针对一条指定连接做点到点可达性诊断；网络访问分析器（Network Access Analyzer）从策略与合规角度搜索可能的网络路径。前者重在“为什么连不上”，后者重在“是否存在不该存在的访问路径”。
English
The two services answer different questions: VPC Reachability Analyzer diagnoses point-to-point reachability for a specified connection, while Network Access Analyzer searches for possible paths from a policy and compliance perspective. The former focuses on why a connection fails; the latter on whether an unauthorized or unintended path exists.
返回顶部 ↑