tui-aws Local Connectivity Checker

Check tab: one data snapshot (4 Describe calls), then a 5-step local evaluation with fix suggestions

tui-aws Local Connectivity Checker Check tab: one data snapshot (4 Describe calls), then a 5-step local evaluation with fix suggestions 01 / Operator - Check Tab 02 / AWS API Snapshot 03 / Source-side Evaluation (local) 04 / Destination-side Evaluation (local) 05 / Verdict EX / Blocked / Cross-check Input + snapshot 5-step local evaluation - checker.go If any step fails Check Input · src, dst, proto, port · Operator - Check Tab › Input + snapshot Check Input src, dst, proto, port Describe x4 · RT, SG, NACL, Subnet · AWS API Snapshot › Input + snapshot · 4 calls Describe x4 RT, SG, NACL, Subnet 4 calls SG Out · 1 - allow rule · Source-side Evaluation (local) › 5-step local evaluation - checker.go SG Out 1 - allow rule NACL Out · 2 - first match · Source-side Evaluation (local) › 5-step local evaluation - checker.go NACL Out 2 - first match Route · 3 - active route · Source-side Evaluation (local) › 5-step local evaluation - checker.go Route 3 - active route NACL In · 4 - first match · Destination-side Evaluation (local) › 5-step local evaluation - checker.go NACL In 4 - first match SG In · 5 - allow rule · Destination-side Evaluation (local) › 5-step local evaluation - checker.go SG In 5 - allow rule Reachable · all 5 steps allow · Verdict › 5-step local evaluation - checker.go · PASS Reachable all 5 steps allow PASS BLOCKED · rule + fix shown · Blocked / Cross-check › If any step fails › 5-step local evaluation - checker.go BLOCKED rule + fix shown Reachability Analyzer · paid AWS API · Blocked / Cross-check › If any step fails › 5-step local evaluation - checker.go · optional Reachability Analyzer paid AWS API optional FAIL at any step R key Legend User UI Agent logic Policy Cloud service External system

One Snapshot, Local Verdict

  • • Data is read once per check via 4 Describe calls
  • • CheckConnectivity is a pure function over that snapshot
  • • Step order mirrors the actual packet path

Failure Output

  • • First failing step stops the check; later steps show Skipped
  • • The blocking rule is named and a /32 fix rule is suggested
  • • R key runs Reachability Analyzer (real API, cost prompt shown)

Not Evaluated

  • • SG-reference (sg-) and prefix-list (pl-) rules never match
  • • Stateless NACL return path on ephemeral ports is skipped
  • • Destination-side return route is not checked

Workflow diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • [/] views • P play story • T theme • E export