Episode 7. Networking. Day 7. The silent killer. Half of all database cases are packets, not queries.

Key facts. VPC subnets span AZs. Security groups are stateful. NACLs are stateless. Route tables steer traffic. VPC endpoints keep S3 and DynamoDB traffic private. PrivateLink exposes services through endpoint interfaces in your VPC. RDS lives in subnets governed by DB subnet groups. Say this: Security group versus NACL confusion causes a large share of database connectivity cases. Interviewers love hearing that.

Scenario 1. The app cannot reach RDS after a VPC change. Timeouts, no error from the engine. Help.

Understand. Ask: same VPC or peered? Private subnets with NAT or isolated? What changed: routes, groups, NACLs, DNS? All clients or one subnet? Exact timeout versus refused?

Prepare. Say the data in order. Security group ingress on 5432 or 3306 from the app groups. NACL rules both directions for ephemeral ports. Route tables: is there a path? DNS resolution of the RDS endpoint. VPC Flow Logs for REJECTs. Reachability Analyzer result.

Say your translation line: Same instinct as listener and sqlnet tracing: prove the packet path before blaming the engine.

Identify. Rank the hypotheses. One: security group missing the app source. Two: NACL blocking return ephemeral ports. Three: route table missing peering or transit gateway propagation. Four: DNS resolving to a stale or cross VPC address. Fix in path order: routes, groups, NACLs, DNS. Never open zero slash zero to fix a database.

Support. Success: connection success rate at baseline, p99 connect time flat, and a Flow Log alarm on REJECT spikes to the DB port.

Scenario 2: PrivateLink versus VPC peering versus Transit Gateway. Say: I'd use PrivateLink to expose one service privately, peering for two VPCs with no overlap, and Transit Gateway for hub and spoke at scale. Then commit. Say: my recommendation is.

Your Day 7 lab: break connectivity on purpose. Remove a security group rule, read the Flow Log REJECT, then restore it. Run Reachability Analyzer before and after.

Tomorrow, Episode 8: performance tuning. Waits, indexes, and autovacuum. The engine room. Understand. Prepare. Identify. Support.