NLB supports stable front-end IP addressing for transport services, independent of registered backend IP changes; that addresses stable allowlisted IP addresses for TCP ingress, rather than ALB weighted canary routing and corrected health checks.

Host-based rules inspect the HTTP Host header so multiple domains can share an ALB without sharing backends; this belongs to request dispatch based on HTTP hostname, while the problem is ALB weighted canary routing and corrected health checks.

In the centrally managed TLS termination at network ingress workflow, NLB TLS listeners terminate TLS at the load balancer using configured certificates while forwarding to supported target protocols; the current case needs ALB weighted canary routing and corrected health checks.

NLB supports stable front-end IP addressing for transport services, independent of registered backend IP changes; that addresses stable allowlisted IP addresses for TCP ingress, rather than centrally managed TLS termination at network ingress.

Client IP behavior depends on target type and protocol, so the target-group setting determines whether source identity survives forwarding; this belongs to preservation of caller source addresses through L4 balancing, while the problem is centrally managed TLS termination at network ingress.

TCP forwarding leaves the application responsible for negotiating TLS with the client instead of terminating TLS at the balancer; this changes backend-side end-to-end TLS termination, not the necessary centrally managed TLS termination at network ingress.

GWLB exchanges encapsulated packets with appliance targets through its GENEVE-based data path rather than ALB HTTP checks or NLB TCP forwarding; that addresses encapsulation compatibility for virtual appliance targets, rather than target distribution across enabled Availability Zones.

ALB inspects HTTP request attributes and can forward traffic to distinct target groups after TLS handling; this belongs to layer-seven path-directed routing, while the problem is target distribution across enabled Availability Zones.

Client IP behavior depends on target type and protocol, so the target-group setting determines whether source identity survives forwarding; this changes preservation of caller source addresses through L4 balancing, not the necessary target distribution across enabled Availability Zones.

NLB supports UDP forwarding at layer four, whereas HTTP-oriented load balancing does not accept arbitrary UDP datagrams; that addresses balancing UDP telemetry packets, rather than encapsulation compatibility for virtual appliance targets.

Client IP behavior depends on target type and protocol, so the target-group setting determines whether source identity survives forwarding; this belongs to preservation of caller source addresses through L4 balancing, while the problem is encapsulation compatibility for virtual appliance targets.

Cross-zone routing permits a load balancer node to distribute to eligible targets in other enabled zones, reducing zonal skew; this changes target distribution across enabled Availability Zones, not the necessary encapsulation compatibility for virtual appliance targets.

Collecting flow logs consistently across VPCs provides evidence for analysis of communication patterns without deploying packet sensors on every host; that addresses consolidated searchable network flow history, rather than metadata-level accept and reject visibility.

CloudFront request logs document delivered CDN requests and response details rather than internal VPC flow metadata; this belongs to edge HTTP request accounting, while the problem is metadata-level accept and reject visibility.

Flow metadata addresses connectivity while HTTP access records reveal application responses, allowing the two failure layers to be separated; this changes correlation of transport connectivity with application-layer denial, not the necessary metadata-level accept and reject visibility.

Flow Logs record network-flow metadata and actions for monitored resources, not full application payload bytes; this belongs to metadata-level accept and reject visibility, while the problem is packet-level analysis of EC2 instance traffic.

CloudFront request logs document delivered CDN requests and response details rather than internal VPC flow metadata; this changes edge HTTP request accounting, not the necessary packet-level analysis of EC2 instance traffic.

In the interpretation of routed paths through transit connectivity workflow, route and attachment inspection reveals how a destination is selected, which CloudWatch utilization metrics alone cannot explain; the current case needs packet-level analysis of EC2 instance traffic.

Traffic Mirroring replicates selected packets toward an analysis target, supporting deeper inspection than flow records; that addresses packet-level analysis of EC2 instance traffic, rather than model-based reachability verification.

Flow Logs record network-flow metadata and actions for monitored resources, not full application payload bytes; this belongs to metadata-level accept and reject visibility, while the problem is model-based reachability verification.

CloudFront request logs document delivered CDN requests and response details rather than internal VPC flow metadata; this changes edge HTTP request accounting, not the necessary model-based reachability verification.

This produces consolidated searchable network flow history: Collecting flow logs consistently across VPCs provides evidence for analysis of communication patterns without deploying packet sensors on every host; the stem instead tests model-based reachability verification.

Reachability Analyzer performs static configuration analysis to explain an allowable path or blocking network component; that addresses model-based reachability verification, rather than cross-network topology and connectivity event inventory.

Route and attachment inspection reveals how a destination is selected, which CloudWatch utilization metrics alone cannot explain; this belongs to interpretation of routed paths through transit connectivity, while the problem is cross-network topology and connectivity event inventory.

In the metadata-level accept and reject visibility workflow, flow Logs record network-flow metadata and actions for monitored resources, not full application payload bytes; the current case needs cross-network topology and connectivity event inventory.

ALB access records contain request-level fields, target information, and response codes for HTTP investigation; that addresses per-request ALB request and target telemetry, rather than edge HTTP request accounting.

Flow Logs record network-flow metadata and actions for monitored resources, not full application payload bytes; this belongs to metadata-level accept and reject visibility, while the problem is edge HTTP request accounting.

ConnectionState communicates physical/logical connection availability and allows actionable alerting on link state changes; this changes automated alerting on Direct Connect connectivity state, not the necessary edge HTTP request accounting.

Traffic Mirroring replicates selected packets toward an analysis target, supporting deeper inspection than flow records; this belongs to packet-level analysis of EC2 instance traffic, while the problem is per-request ALB request and target telemetry.

CloudFront request logs document delivered CDN requests and response details rather than internal VPC flow metadata; this changes edge HTTP request accounting, not the necessary per-request ALB request and target telemetry.

In the metadata-level accept and reject visibility workflow, flow Logs record network-flow metadata and actions for monitored resources, not full application payload bytes; the current case needs per-request ALB request and target telemetry.

Representative baseline measurements are necessary to attribute later performance changes rather than relying only on a post-change snapshot; that addresses defensible before-and-after network performance comparisons, rather than automated alerting on Direct Connect connectivity state.

CloudFront request logs document delivered CDN requests and response details rather than internal VPC flow metadata; this belongs to edge HTTP request accounting, while the problem is automated alerting on Direct Connect connectivity state.

In the metadata-level accept and reject visibility workflow, flow Logs record network-flow metadata and actions for monitored resources, not full application payload bytes; the current case needs automated alerting on Direct Connect connectivity state.