A developer is building a three-tier application with an Application Load Balancer (ALB), Amazon EC2 instances, and Amazon RDS. There is an alias record in Amazon Route 53 that points to the ALB. When

VPC Flow Logs record accepted and rejected traffic at the network interface level within the VPC, including traffic directed at the ALB. By inspecting these logs, a developer can determine whether the timed-out request ever entered the AWS network, identify if a security group or network ACL is blocking traffic, and pinpoint the exact network hop where the failure occurs.

Route 53 query logs record DNS resolution requests and responses but do not capture whether subsequent TCP/HTTP traffic reaches the ALB or AWS network.

AWS Systems Manager Agent logs relate to SSM agent operations on EC2 instances and do not capture inbound network traffic to the load balancer.

CloudWatch agent logs collect OS-level and application metrics from EC2 instances but do not capture network-level traffic flow between the client and the ALB.