TIL AWS added a VPC reachability analyzer: give it a source and a destination endpoint, maybe a port, hit a button, (wait a few minutes), it says if that path works... and why it doesn't! https://console.aws.amazon.com/vpc/home?region=us-east-1#ReachabilityAnalyzer: