→

→

DSA in Python: A Practical Roadmap for Beginners

Python

DSA in Python: A Practical Roadmap for Beginners

DSA in Python: A Practical Roadmap for Beginners

Learn data structures and algorithms in Python with a clear topic order, worked examples, a complexity cheat sheet and an eight-week practice plan.

Learn data structures and algorithms in Python with a clear topic order, worked examples, a complexity cheat sheet and an eight-week practice plan.

Learn data structures and algorithms in Python with a clear topic order, worked examples, a complexity cheat sheet and an eight-week practice plan.

By YourCloudDude

•

•

16 min read

DSA in Python roadmap showing arrays, hash maps, trees and graphs connected by blue arrows on a graph-paper background

To learn DSA in Python, start with lists, strings, dictionaries and sets. Learn Big O alongside them, then practise two pointers, sliding windows, stacks, queues and binary search. Move on to trees, heaps, graphs, backtracking and dynamic programming. For every solution, explain why it works, test edge cases and account for time and memory.

DSA means data structures and algorithms. Data structures organise information; algorithms describe the steps used to process it. Together, they help you choose a solution that remains understandable and efficient as the input grows.

This guide is for learners who can already write small Python functions. It gives you a practical order, examples you can run and checkpoints that show whether you understand a topic. The eight-week schedule is a suggested starting plan; adjust it to your experience and available time.

What should you know before starting DSA in Python?

You do not need to finish every Python topic before starting. You should be comfortable reading a function, following a loop and predicting how a collection changes. That foundation lets you focus on reasoning instead of fighting syntax.

  • Write functions with parameters and return values; distinguish returning a value from printing it.

  • Use loops, conditions, enumerate, range and basic comprehensions.

  • Read and update lists and dictionaries; understand indexing, slicing and mutable objects.

  • Read a traceback and write assertions for expected results.

  • Understand simple classes before implementing linked-list or tree nodes.

If these ideas are still unfamiliar, begin with the Python Kickstarter and return when you can write and test a small function independently.

The DSA in Python roadmap at a glance

Stage

Learn

Checkpoint

1. Foundations

Lists, strings, dict, set and Big O

Choose a collection and explain its cost.

2. Array patterns

Hashing, two pointers, sliding window and prefix sums

State what stays true as pointers move.

3. Linear structures

Stacks, queues and linked lists

Trace insertions, removals and references.

4. Searching and ordering

Binary search, sorting and heaps

Explain the ordering or heap invariant.

5. Connected structures

Trees, BFS, DFS and graphs

Visit nodes without repeating work.

6. Search and optimisation

Backtracking, greedy reasoning and dynamic programming

Define the state, choices and correctness argument.

Study one topic, solve a few variations and revisit it later without your notes. A long list of completed problems is less useful if you cannot explain which constraint made a technique appropriate.

Big O: measure the work your solution does

Big O describes how a cost grows with input size. O(1) is constant growth; O(log n) repeatedly reduces the search space; O(n) processes input proportionally; O(n log n) often appears in comparison sorting; O(n²) commonly appears when every item is compared with every other item. It describes growth, not an exact time in milliseconds.

Count the operations inside a loop as well as the loop itself. A single loop containing a linear search can still be quadratic. Two separate passes over an input are O(n), because constants disappear from this growth model. Nested loops are not automatically quadratic: their total iteration count is what matters.

Python operation

Typical cost

Remember

items[i]; len(items)

O(1)

Direct list indexing and stored length.

items.append(x); items.pop()

O(1) amortized

An individual resize can cost more.

items.pop(0); x in items

O(n)

Moving entries or scanning the list.

items[a:b]

O(k)

Copies k selected entries.

key in mapping; x in a_set

O(1) average; O(n) worst case

Assumes constant-cost hashing/equality.

sorted(items)

O(n log n) worst case

Returns a new list.

deque.append(x); deque.popleft()

O(1)

Use queue operations at the ends.

bisect_left(sorted_items, x)

O(log n)

Finding a position is not inserting.

heapq.heappush; heapq.heappop

O(log n)

A heap is not a fully sorted list.

These costs describe ordinary CPython collections and standard algorithm assumptions. See the official built-in complexity reference, deque documentation, bisect performance notes and heapq documentation for implementation details.

Track auxiliary space too: a copied list, a visited set or a recursion stack uses memory. State whether your space bound excludes the input and includes the returned output. The examples below use ordinary fixed-size integer/key assumptions; very large integers and expensive custom comparisons can add costs.

Lists, dictionaries and sets: build your first useful patterns

Use hashing when you need fast repeated lookup

A list preserves a sequence of values. A dictionary associates keys with values; a set tracks distinct values. For a two-sum problem, a dictionary can store a previously seen number and its index, so you can check for the missing partner as you scan.

def two_sum(nums: list[int], target: int) -> list[int]:
    seen = {}
    for index, value in enumerate(nums):
        needed = target - value
        if needed in seen:
            return [seen[needed], index]
        seen[value] = index
    return []

assert two_sum([2, 7, 11, 15], 9) == [0, 1]
assert two_sum([3, 3], 6) == [0, 1]
assert two_sum([], 9) == []
def two_sum(nums: list[int], target: int) -> list[int]:
    seen = {}
    for index, value in enumerate(nums):
        needed = target - value
        if needed in seen:
            return [seen[needed], index]
        seen[value] = index
    return []

assert two_sum([2, 7, 11, 15], 9) == [0, 1]
assert two_sum([3, 3], 6) == [0, 1]
assert two_sum([], 9) == []
def two_sum(nums: list[int], target: int) -> list[int]:
    seen = {}
    for index, value in enumerate(nums):
        needed = target - value
        if needed in seen:
            return [seen[needed], index]
        seen[value] = index
    return []

assert two_sum([2, 7, 11, 15], 9) == [0, 1]
assert two_sum([3, 3], 6) == [0, 1]
assert two_sum([], 9) == []

The dictionary contains only indices already visited. Checking before inserting prevents using the same position twice. Expected time is O(n), with O(n) auxiliary space. The function returns one valid pair of distinct indices, or an empty list when no pair exists.

  • Practise: frequency counts, first repeated item, duplicate detection and grouping anagrams.

  • Watch for: assuming set iteration gives sorted order or confusing a dictionary key with a list index.

  • Checkpoint: explain when the extra lookup structure is worth the memory.

Two pointers, sliding windows and prefix sums

Two pointers work when moving through a sequence lets you discard possibilities safely. In a sorted pair-sum problem, a total that is too small tells you to move the left pointer. Without sorted input, that decision is not justified.

A sliding window represents a contiguous region. Expand it to include a new item, then shrink or reposition it when the rule is broken. A useful example is the longest substring containing no repeated characters.

def longest_unique_length(text: str) -> int:
    last_seen = {}
    left = 0
    best = 0
    for right, char in enumerate(text):
        left = max(left, last_seen.get(char, -1) + 1)
        last_seen[char] = right
        best = max(best, right - left + 1)
    return best

assert longest_unique_length("abcabcbb") == 3
assert longest_unique_length("abba") == 2
assert longest_unique_length("") == 0
def longest_unique_length(text: str) -> int:
    last_seen = {}
    left = 0
    best = 0
    for right, char in enumerate(text):
        left = max(left, last_seen.get(char, -1) + 1)
        last_seen[char] = right
        best = max(best, right - left + 1)
    return best

assert longest_unique_length("abcabcbb") == 3
assert longest_unique_length("abba") == 2
assert longest_unique_length("") == 0
def longest_unique_length(text: str) -> int:
    last_seen = {}
    left = 0
    best = 0
    for right, char in enumerate(text):
        left = max(left, last_seen.get(char, -1) + 1)
        last_seen[char] = right
        best = max(best, right - left + 1)
    return best

assert longest_unique_length("abcabcbb") == 3
assert longest_unique_length("abba") == 2
assert longest_unique_length("") == 0

The window from left through right contains no repeated characters. The max prevents left from moving backwards when an older duplicate is already outside the window. Expected time is O(n), and auxiliary space is O(u), where u is the number of distinct characters encountered. This treats Python string elements as characters, not user-perceived grapheme clusters.

Prefix sums store cumulative totals so a range sum can be answered by subtraction. For nums = [2, 4, 1], build prefix = [0, 2, 6, 7]. The sum over the half-open range [1, 3) is prefix[3] - prefix[1], or 5. Building the prefix array takes O(n) time and space; each subsequent range query is O(1).

  • Practise: sorted pair sum, maximum sum of a fixed-size window and repeated range-sum queries.

  • Watch for: mixing inclusive and exclusive boundaries.

  • Checkpoint: state the window rule before writing the loop. A variable-size sum window may fail when negative values break the monotonic behaviour you rely on.

Stacks, queues and linked lists

A stack processes the most recently added item first. Use list.append and list.pop for bracket matching, undo histories or an iterative depth-first traversal. A queue processes the oldest pending item first, which is useful for breadth-first exploration.

For a Python queue, use collections.deque with append and popleft. Repeated list.pop(0) shifts the remaining entries and can turn a traversal into unnecessary quadratic work.

A linked list stores values in nodes connected by references. Practise reversing a list and using slow/fast pointers to detect a cycle. Keep track of the next reference before overwriting a link. Finding a position still requires traversal; constant-time insertion assumes you already have the relevant node reference.

  • Practise: valid brackets, a queue simulation, reversing a linked list and cycle detection.

  • Watch for: popping an empty stack and losing access to the remaining linked-list nodes.

  • Checkpoint: draw each reference change on paper before running the code.

Binary search, sorting and heaps

Binary search needs an ordered search space and a rule that safely eliminates part of it. Begin with a sorted list, then learn how to search for a boundary or the first value satisfying a monotonic condition.

from bisect import bisect_left

def find_sorted(nums: list[int], target: int) -> int:
    index = bisect_left(nums, target)
    if index < len(nums) and nums[index] == target:
        return index
    return -1

assert find_sorted([1, 3, 3, 7], 3) == 1
assert find_sorted([1, 3, 7], 5) == -1
assert find_sorted([], 3) == -1
from bisect import bisect_left

def find_sorted(nums: list[int], target: int) -> int:
    index = bisect_left(nums, target)
    if index < len(nums) and nums[index] == target:
        return index
    return -1

assert find_sorted([1, 3, 3, 7], 3) == 1
assert find_sorted([1, 3, 7], 5) == -1
assert find_sorted([], 3) == -1
from bisect import bisect_left

def find_sorted(nums: list[int], target: int) -> int:
    index = bisect_left(nums, target)
    if index < len(nums) and nums[index] == target:
        return index
    return -1

assert find_sorted([1, 3, 3, 7], 3) == 1
assert find_sorted([1, 3, 7], 5) == -1
assert find_sorted([], 3) == -1

This returns the leftmost matching index, or -1. Search takes O(log n) time and O(1) auxiliary space for a list of ordinary comparable values. Sorting beforehand costs extra, so include that work when analysing an unsorted-input solution.

The bisect reference distinguishes a logarithmic search from insort, whose list insertion is O(n). A fast search does not make moving list elements free.

Use sorted when you need a new ordered list and list.sort when changing the original list is acceptable. Understand merge sort as an example of divide and conquer. Learn why quicksort performance depends on partitioning, and why a binary search tree is not automatically balanced.

A heap keeps a priority item accessible without maintaining a completely sorted sequence. Use a min-heap for repeatedly selecting the smallest pending value; practise keeping only the largest k items with a heap of size k.

  • Practise: first/last occurrence, merging intervals, kth-largest values and scheduling by priority.

  • Watch for: reading heap storage as sorted output; only the heap ordering invariant is guaranteed.

  • Checkpoint: explain why you need a sorted sequence, a boundary search or just the next priority item.

Trees and graphs: learn BFS and DFS

A tree connects nodes hierarchically without cycles. A graph can represent routes, dependencies or relationships, including cycles and disconnected components. Use an adjacency list to describe each vertex’s neighbours.

Breadth-first search, or BFS, visits vertices by increasing number of edges from the start. It can find the shortest distance in an unweighted graph. Depth-first search, or DFS, follows a branch before returning and is useful for exploring components and dependencies.

from collections import deque

def shortest_hops(graph, start, target):
    queue = deque([(start, 0)])
    visited = {start}
    while queue:
        node, distance = queue.popleft()
        if node == target:
            return distance
        for neighbour in graph.get(node, ()):
            if neighbour not in visited:
                visited.add(neighbour)
                queue.append((neighbour, distance + 1))
    return None

graph = {"A": ["B", "C"], "B": ["D"],
         "C": ["D"], "D": []}
assert shortest_hops(graph, "A", "D") == 2
assert shortest_hops(graph, "D", "A") is None
assert shortest_hops(graph, "A", "A") == 0
from collections import deque

def shortest_hops(graph, start, target):
    queue = deque([(start, 0)])
    visited = {start}
    while queue:
        node, distance = queue.popleft()
        if node == target:
            return distance
        for neighbour in graph.get(node, ()):
            if neighbour not in visited:
                visited.add(neighbour)
                queue.append((neighbour, distance + 1))
    return None

graph = {"A": ["B", "C"], "B": ["D"],
         "C": ["D"], "D": []}
assert shortest_hops(graph, "A", "D") == 2
assert shortest_hops(graph, "D", "A") is None
assert shortest_hops(graph, "A", "A") == 0
from collections import deque

def shortest_hops(graph, start, target):
    queue = deque([(start, 0)])
    visited = {start}
    while queue:
        node, distance = queue.popleft()
        if node == target:
            return distance
        for neighbour in graph.get(node, ()):
            if neighbour not in visited:
                visited.add(neighbour)
                queue.append((neighbour, distance + 1))
    return None

graph = {"A": ["B", "C"], "B": ["D"],
         "C": ["D"], "D": []}
assert shortest_hops(graph, "A", "D") == 2
assert shortest_hops(graph, "D", "A") is None
assert shortest_hops(graph, "A", "A") == 0

Marking a vertex when it enters the queue prevents repeated enqueuing. For the reachable part of an adjacency-list graph, expected time is O(V + E) and auxiliary space is O(V), assuming constant-cost vertex hashing. Missing adjacency entries are treated as vertices with no outgoing edges. The function returns a distance, not the route itself.

BFS does not solve arbitrary weighted shortest-path problems. Learn Dijkstra’s algorithm when edge weights are nonnegative, and learn its assumptions before using it. For deep trees or graphs, an explicit stack can avoid the recursion-depth problem of a recursive DFS.

  • Practise: tree traversals, maximum tree depth, counting connected components and shortest unweighted routes.

  • Watch for: missing a visited set, assuming every graph is connected or treating a directed edge as bidirectional.

  • Checkpoint: explain what is stored in the frontier and why the next removed node is safe to process.

Backtracking, greedy algorithms and dynamic programming

Backtracking explores choices, then undoes a choice before trying another branch. Use it for subsets, permutations and constrained searches. Draw a small decision tree and identify when a partial answer can be rejected early. Producing all subsets already requires exponential-size output; no implementation trick removes that output cost.

A greedy algorithm commits to a local choice. It needs a reason that this choice can still lead to an optimal complete answer. Test the proposed rule on counterexamples before trusting it. Choosing the largest coin first, for example, fails for some coin systems.

Dynamic programming stores answers to states that would otherwise be solved repeatedly. Define the state, transition, base cases and evaluation order before optimising storage. Counting ways to climb stairs with steps of one or two gives a compact first example.

def count_stair_ways(n: int) -> int:
    if n < 0:
        raise ValueError("n must be nonnegative")
    previous, current = 1, 1
    for _ in range(n):
        previous, current = current, previous + current
    return previous

assert count_stair_ways(0) == 1
assert count_stair_ways(1) == 1
assert count_stair_ways(5) == 8
def count_stair_ways(n: int) -> int:
    if n < 0:
        raise ValueError("n must be nonnegative")
    previous, current = 1, 1
    for _ in range(n):
        previous, current = current, previous + current
    return previous

assert count_stair_ways(0) == 1
assert count_stair_ways(1) == 1
assert count_stair_ways(5) == 8
def count_stair_ways(n: int) -> int:
    if n < 0:
        raise ValueError("n must be nonnegative")
    previous, current = 1, 1
    for _ in range(n):
        previous, current = current, previous + current
    return previous

assert count_stair_ways(0) == 1
assert count_stair_ways(1) == 1
assert count_stair_ways(5) == 8

ways(n) equals ways(n - 1) + ways(n - 2): the last move was either one or two steps. There is one way to climb zero steps: take no steps. This implementation performs O(n) additions and keeps O(1) integer variables. The integers themselves grow with n, so constant variable count does not imply constant bit-space for arbitrarily large inputs.

  • Practise: subsets, combination searches, interval scheduling and minimum-cost grid paths.

  • Watch for: memoizing a state that omits information needed for future decisions.

  • Checkpoint: describe a state in one sentence and explain why each dependency has already been computed.

An eight-week DSA practice plan

Use this as an adjustable study schedule, not a promise of interview readiness. If you cannot solve a small variation without copying, repeat that stage. A suggested session is 10 minutes reviewing an earlier problem, 30 minutes solving and 15 minutes testing and writing notes.

Week

Focus

Deliverable

1

Python collections and Big O

A collection-choice cheat sheet and frequency counter.

2

Hashing, two pointers and windows

Explain three window or pointer invariants.

3

Stacks, queues and linked lists

Trace queue operations and reverse node links.

4

Sorting and binary search

Implement a search and test every boundary.

5

Trees and heaps

Compare traversal orders and maintain a top-k heap.

6

Graphs, BFS and DFS

Build a route finder with unreachable-case tests.

7

Backtracking, greedy reasoning and DP

Draw a search tree and a small DP state table.

8

Mixed review and a practical project

A README explaining correctness, tests and costs.

Aim first for two or three carefully reviewed problems per topic, then add variations. Re-solve one the following day and again after a week. This is a suggested routine rather than a universal problem-count target. The useful signal is whether you recognise the structure and justify your choices.

How to solve a DSA problem without memorising the answer

  1. Clarify the contract: input shape, output, duplicates, ordering, mutation and allowed values.

  2. Work a tiny example by hand, including an empty input or a missing result.

  3. Write a correct straightforward approach and estimate its cost.

  4. Identify repeated work or an invariant that enables a better approach.

  5. Implement the idea, explaining what each state variable represents.

  6. Test boundaries and adversarial examples; compare small cases with the straightforward version.

  7. Record the time and auxiliary-space bounds with their assumptions.

Use an AI assistant to request hints, counterexamples or a review of your complexity argument. Try the problem yourself before asking for a full solution. Then explain the result without the assistant and run it: a plausible explanation is not evidence that code handles duplicate values or boundary conditions.

For interviews, practise talking through decisions while writing readable code. Ask about constraints before optimising. There is no algorithm checklist or number of solved questions that guarantees a job offer.

Turn DSA practice into a small Python project

Project

DSA idea

What to demonstrate

Duplicate-record checker

Sets and dictionaries

A clear identity rule and duplicate reporting.

Top-k word analyser

Frequency map and heap

Tie handling, input limits and memory choices.

Unweighted route finder

Adjacency lists and BFS

Cycles, missing routes and route reconstruction.

Undoable text editor

Stacks

Consistent undo/redo state and boundary tests.

Choose one project and document the input contract, the structure you selected, the alternatives you rejected and the tests you ran. Measure representative inputs after you have a correct solution; small timings alone cannot establish an asymptotic complexity bound.

For project ideas beyond exercises, explore the Python Project Vault. The Python Bundle brings together broader Python learning resources; use the product page to check its current contents. This article’s DSA roadmap is a standalone study plan.

If your longer-term goal is AI development, continue with What to Learn in Python for AI in 2027 to connect Python fundamentals with APIs, data and application testing.

Frequently asked questions about DSA in Python

Is Python good for learning data structures and algorithms?

Yes. Python’s concise syntax lets you focus on the algorithm, while lists, dictionaries, sets, deque and heapq cover many common tasks. You still need to understand the costs of those operations and any restrictions of your interview or programming platform.

Should I learn Python or DSA first?

Learn enough Python to write functions, loops and collection operations, then study them together. Add classes when you reach linked structures. You do not need web frameworks, machine learning or advanced metaprogramming before beginning DSA.

How long does it take to learn DSA in Python?

The eight-week plan above is an introduction for someone with basic Python knowledge. Depth, retention and interview readiness take further practice and depend on your starting point. Advance when you can explain and test unfamiliar variations, rather than when a calendar says you should.

Do I need DSA for AI and automation?

Basic collection choice, complexity analysis, queues and search are useful when processing records or coordinating work. Advanced interview-style DSA is not a prerequisite for every AI application. Match your depth to the tasks and hiring expectations you actually face.

Do I have to implement every structure from scratch?

Implement a few to understand their behaviour, especially linked lists, tree traversal and a basic search. In ordinary projects, use well-tested built-ins and standard-library tools when they fit. Knowing how a structure works helps you use the existing implementation responsibly.

Your next step

Start with the two-sum example. Predict its behaviour on [3, 3] before running it, write a simple double-loop alternative and compare the two explanations. Then solve a different lookup problem without notes. That small cycle of reasoning, implementation and testing is the habit this roadmap is designed to build.

Browse Python resources when you want a structured foundation or a practical project to apply next.

Official Python references

Python data structures tutorial — lists, dictionaries, sets and collection operations.

Time complexity of built-in types — CPython operation costs and assumptions.

collections.deque — queues and efficient operations at both ends.

bisect — sorted search, insertion points and performance notes.

heapq — priority queues and heap operations.

AWS CloudOps · Troubleshooting

Deploying an AWS resource is only half the skill. The harder part begins when an instance cannot be reached, an API returns 502, an IAM request is denied or an application suddenly loses database connectivity.

This AWS troubleshooting guide is not a list of definitions or a collection of random fixes. It teaches a repeatable process for identifying the broken layer, tracing the request, testing one hypothesis at a time and proving the fix.

The objective is not to memorize every AWS error. It is to develop a CloudOps method you can reuse across EC2, IAM, S3, VPC, Lambda, API Gateway, RDS and load balancers.

Good troubleshooting is not guessing faster. It is eliminating possibilities systematically.

Quick answer

How Do You Troubleshoot an AWS Problem?

Read the exact symptom, identify the most likely layer, check recent changes and telemetry, trace the request, isolate one component, find the root cause, fix it, verify the behavior and prevent recurrence.

How Cloud Engineers Debug AWS
Read symptom
Identify layer
Recent changes
Metrics + logs
Trace request
Isolate
Root cause
Fix
Verify
Prevent
Jump to a failure

Request path

First Identify Which Layer Is Broken

A request usually crosses several layers. Do not begin by checking random services. Determine where the request stops, then investigate that boundary.

Trace the Request
User
DNS
Network
Load Balancer
Compute
Application
Database
Dependencies
IAM / SecurityMonitoringConfiguration
01

Failure 01 · EC2

EC2 Instance Is Running but SSH Times Out

Symptom

The instance is running, but an SSH connection to port 22 times out.

Most likely layer

Networking

Typical causes

  • Wrong Region or public address
  • Port 22 is not allowed from your trusted source
  • No internet-gateway route for the subnet
  • A network ACL or local firewall blocks the path
  • The SSH service or instance is not ready

Architecture

EC2 troubleshooting path
Laptop
Internet
Internet Gateway
Route Table
Security Group
EC2 :22

How to Diagnose It

  1. Confirm the account, Region, instance state and status checks.
  2. Confirm the intended connectivity model: public IPv4/IPv6, EC2 Instance Connect Endpoint, VPN, bastion or Systems Manager.
  3. For a public path, verify the address, attached internet gateway and the subnet route.
  4. Allow SSH only from the required trusted IP or network; do not open port 22 globally as a shortcut.
  5. Check network ACLs, the local/corporate firewall, the AMI user name and SSH service.
  6. Use VPC Reachability Analyzer when a configuration-path analysis will help isolate the blocking component.

Root cause example

The instance was healthy, but its subnet route table had no route to the attached internet gateway.

Fix

Restore the intended route or use the approved private-access method, then keep the security-group source narrowly scoped.

How to verify the fix

Reconnect using the correct address and user, confirm the host key, then test the application from the same approved path.

Prevent it next time

  • Use reviewed network templates
  • Prefer managed private access where practical
  • Document the approved connection path
02

Failure 02 · IAM

AWS Says “AccessDenied”

Symptom

An AWS API request is rejected with AccessDenied or not authorized.

Most likely layer

Identity and authorization

Typical causes

  • The active user or role is not the identity you expected
  • No applicable Allow grants the exact action and resource
  • An identity, resource, boundary, session or organization policy explicitly denies it
  • A policy condition does not match
  • The request uses the wrong role session context

Architecture

IAM troubleshooting path
User / Role
Policy Evaluation
Allow or Deny
AWS Resource

How to Diagnose It

  1. Capture the exact principal, action, resource ARN and error context.
  2. Run aws sts get-caller-identity when using the CLI or SDK.
  3. Review identity policies and the resource policy where the service supports one.
  4. Check permissions boundaries, session policies, service control policies and applicable conditions.
  5. Distinguish an implicit deny caused by no matching Allow from an explicit Deny, which wins over an Allow.

Root cause example

The application assumed a deployment role whose session policy omitted the required resource ARN.

Fix

Grant only the required action on the intended resource in the correct policy layer, or correct the role/session being used.

How to verify the fix

Repeat the same request as the same principal and confirm CloudTrail records the expected allowed action.

Prevent it next time

  • Use least-privilege policy reviews
  • Log the principal ARN in deployments
  • Test permission boundaries before release
03

Failure 03 · S3

S3 Returns 403 Access Denied

Symptom

An application can reach Amazon S3 but receives HTTP 403 for a bucket or object operation.

Most likely layer

Authorization

Typical causes

  • IAM or bucket policy does not allow the operation
  • An explicit deny or Block Public Access setting rejects the request context
  • Object ownership or cross-account context differs
  • A customer-managed KMS key policy lacks required access
  • A presigned URL is expired or signed for a different request

Architecture

S3 troubleshooting path
Application
IAM Role
S3 Authorization
Bucket / Object

How to Diagnose It

  1. Identify the caller with sts get-caller-identity and record the exact S3 action.
  2. Check the bucket ARN versus object ARN and review both identity and bucket policies.
  3. Inspect Object Ownership and any cross-account path.
  4. For SSE-KMS objects, verify the relevant KMS permissions and key policy.
  5. For presigned URLs, check expiry, method, headers, Region and the signer’s permissions.

Root cause example

The role could read the bucket, but the object used a customer-managed KMS key that the role could not decrypt.

Fix

Correct the narrowly scoped S3 and, when required, KMS permissions. Keep the bucket private unless public access is truly intended.

How to verify the fix

Repeat the exact object operation as the same role and confirm the correct object is returned without broadening public access.

Prevent it next time

  • Test the real runtime role
  • Standardize bucket ownership
  • Review S3 and KMS policies together
04

Failure 04 · ALB

Application Load Balancer Says Target Is Unhealthy

Symptom

A registered EC2 or ECS target fails the target group health check.

Most likely layer

Application and network

Typical causes

  • Health-check path does not exist
  • Health-check port differs from the listening port
  • The target security group blocks the load balancer
  • The service has not started or is bound to the wrong interface
  • The returned status code is outside the configured success matcher

Architecture

ALB troubleshooting path
Users
ALB
GET /health :8080
EC2 / ECS

How to Diagnose It

  1. Read the target health reason code before changing settings.
  2. Confirm protocol, port, path, timeout and success-code matcher.
  3. From inside the VPC, request the same path on the target’s private address and port.
  4. Verify the target security group allows the load balancer security group.
  5. Check application startup logs and confirm the process is listening on the expected interface and port.

Root cause example

The target group checked /health on port 8080, while the application listened on port 3000.

Fix

Align the target group health check with the application or correct the application listener, while preserving least-privilege security-group rules.

How to verify the fix

Wait for the healthy threshold, confirm the target becomes Healthy and make a request through the load balancer.

Prevent it next time

  • Expose a lightweight health endpoint
  • Keep app and infrastructure ports in one configuration source
  • Alert on healthy-host count
05

Failure 05 · Lambda

Lambda Function Times Out

Symptom

The function reaches its configured timeout before returning a response.

Most likely layer

Runtime and dependency

Typical causes

  • A downstream API or database is slow
  • A network call has no shorter client timeout
  • VPC routing, NAT or security rules block an outbound dependency
  • The workload needs more CPU or a different design
  • The function is waiting, retrying or processing too much in one invocation

Architecture

Lambda troubleshooting path
Event
Lambda
External Dependency
Response

How to Diagnose It

  1. Use the REPORT line and logs to find where duration is spent.
  2. Add timing around external calls and inspect the last successful log statement.
  3. Test downstream availability and configure explicit connection/read timeouts.
  4. If VPC-connected, check routes, security groups, DNS and NAT or service endpoints.
  5. Test memory settings because Lambda allocates CPU proportionally with memory, but do not treat more memory as a substitute for finding a blocked call.

Root cause example

A VPC-connected function called a public API from a private subnet with no working outbound path.

Fix

Restore the required network path or use an appropriate private endpoint, and set bounded client timeouts and retries.

How to verify the fix

Invoke with representative events, confirm duration stays below the timeout and verify the dependency receives the expected request.

Prevent it next time

  • Instrument dependency latency
  • Use bounded retries and timeouts
  • Alarm on errors, duration and throttles
06

Failure 06 · API

API Gateway Returns 502 Internal Server Error

Symptom

A client receives 502 from an API Gateway endpoint backed by Lambda.

Most likely layer

Integration response

Typical causes

  • The Lambda function ran but returned an error
  • The proxy response has the wrong shape or a non-string body
  • The function version or alias is not the one expected
  • Integration logging is incomplete
  • The integration contract differs from the deployed API

Architecture

API troubleshooting path
Client
API Gateway
Lambda
Response Contract

How to Diagnose It

  1. Capture the request ID and enable useful API access/execution logging for the API type.
  2. Open the corresponding Lambda log stream and locate the same request.
  3. Invoke the function with the API event shape.
  4. For a Lambda proxy integration, validate statusCode, headers, isBase64Encoded when used, and a string body.
  5. Distinguish invocation rejection, which can surface as 500, from a function error or malformed proxy response, which AWS documents as 502.

Root cause example

The function returned body as an object instead of a JSON string in a proxy response.

Fix

Return the response contract expected by the integration and handle application errors deliberately.

How to verify the fix

Call the deployed stage, confirm the intended HTTP status/body and correlate the request in API Gateway and Lambda logs.

Prevent it next time

  • Contract-test integration responses
  • Log request IDs
  • Deploy API and Lambda changes together
07

Failure 07 · RDS

Application Cannot Connect to RDS

Symptom

The application cannot establish or authenticate a database connection.

Most likely layer

Network, authentication or configuration

Typical causes

  • Wrong endpoint, port or database name
  • The DB security group does not allow the application security group
  • Subnet routing, peering or network ACLs block the path
  • The DB is unavailable or still starting
  • Credentials or secrets are wrong or stale

Architecture

RDS troubleshooting path
Application
App Security Group
VPC Path
DB Security Group
RDS

How to Diagnose It

  1. Classify the error: DNS failure, connection timeout/refused, TLS failure or authentication rejection.
  2. Confirm the current RDS endpoint, port, engine status and Region.
  3. Test DNS and TCP reachability from the application environment.
  4. Verify the DB security group allows the application security group or the required trusted source.
  5. Only after the network path works, verify the secret, database user, TLS mode and application connection string.

Root cause example

A new application security group was deployed, but the DB inbound rule still referenced the old group.

Fix

Restore the intended security-group relationship or correct the connection configuration and credentials.

How to verify the fix

Connect from the application runtime, run a harmless query and confirm the app’s connection-pool health.

Prevent it next time

  • Reference security groups rather than broad CIDRs
  • Monitor connections and DB availability
  • Rotate and test secrets safely
08

Failure 08 · VPC

Two AWS Resources Cannot Communicate Inside a VPC

Symptom

A source resource cannot reach a destination on a known protocol and port.

Most likely layer

Network path

Typical causes

  • The destination security group does not allow the source
  • A route is missing or points to the wrong target
  • A network ACL blocks the request or return path
  • The resources are in unconnected VPCs or overlapping networks
  • The destination service is not listening

Architecture

VPC troubleshooting path
Source
Source SG
Route
Subnet / NACL
Destination SG
Destination

How to Diagnose It

  1. Write down source, destination, protocol and port.
  2. Confirm the destination is listening and its address is current.
  3. Inspect security groups in both directions of the intended stateful flow.
  4. Trace route tables, peering/transit-gateway attachments and network ACL rules.
  5. Use VPC Reachability Analyzer to analyze configured reachability and identify a blocking component.

Root cause example

The destination security group allowed the old source CIDR but not the source instance’s security group.

Fix

Correct the narrow network control or route that breaks the intended path, then confirm the service is listening.

How to verify the fix

Test the exact protocol and port from the source and rerun the path analysis after the configuration change.

Prevent it next time

  • Document flows as source–destination–port
  • Review network changes
  • Use repeatable infrastructure definitions
09

Failure 09 · CLI

AWS CLI Shows No Resources but They Exist in the Console

Symptom

A list command returns no resources while the console shows them.

Most likely layer

Configuration

Typical causes

  • The CLI uses a different Region
  • The active profile belongs to another account
  • A different role is assumed
  • Environment credentials override the profile
  • A command filter excludes the resource

Architecture

CLI troubleshooting path
CLI Profile
Account
Region
List / Filter

How to Diagnose It

  1. Run aws sts get-caller-identity.
  2. Run aws configure list and inspect environment variables.
  3. Print the effective Region and compare it with the console.
  4. Retry without optional filters and confirm the service is regional or global as expected.

Root cause example

The console displayed Account A in us-east-1 while the CLI profile used Account B in eu-west-1.

Fix

Select the intended profile and Region explicitly, then remove or correct the filter.

How to verify the fix

Repeat the list command and compare the returned resource ID with the console.

Prevent it next time

  • Name profiles clearly
  • Show account and Region in shell prompts
  • Pass Region explicitly in automation
10

Failure 10 · Logs

The App Is Broken but CloudWatch Shows “Nothing”

Symptom

The application fails, but the expected CloudWatch log group or log events are empty.

Most likely layer

Observability

Typical causes

  • The wrong account, Region, log group or stream is open
  • Application or service logging is not configured
  • The delivery role lacks required log permissions
  • The request never reaches the expected code path
  • Retention or log routing removed or redirected the events

Architecture

Logs troubleshooting path
Application
Logging
CloudWatch Logs
Query / Alarm

How to Diagnose It

  1. Confirm account, Region, time range, log group and stream.
  2. Check whether the service must have logging enabled and whether the destination exists.
  3. Verify the execution or delivery role can create streams and put log events when those permissions are required.
  4. Add a known startup or request-boundary log and test again.
  5. Check metrics separately: metrics and logs are different signals, and one can exist without the other.

Root cause example

The application failed at the load balancer and never invoked the code path that emitted application logs.

Fix

Restore logging configuration or permissions, then instrument the earliest useful boundary in the request path.

How to verify the fix

Generate a controlled request and confirm a timestamped event, correlation ID and expected metric appear in the correct account and Region.

Prevent it next time

  • Provision logging with the workload
  • Use correlation IDs
  • Alert on missing expected telemetry

Save this

AWS Troubleshooting Cheat Sheet

SymptomCheck firstLikely layer
EC2 SSH timeoutNetwork path + security groupNetworking
AccessDeniedIAM evaluationIdentity and authorization
S3 403IAM + bucket policyAuthorization
ALB unhealthyHealth checkApplication and network
Lambda timeoutLogs + dependencyRuntime and dependency
API 502Lambda + response contractIntegration response
RDS timeoutNetwork + DB security groupNetwork, authentication or configuration
VPC connection failsPath analysisNetwork path
CLI resource missingAccount + RegionConfiguration
No logsLogging configurationObservability

EC2 SSH timeout

Check firstNetwork path + security group
LayerNetworking

AccessDenied

Check firstIAM evaluation
LayerIdentity and authorization

S3 403

Check firstIAM + bucket policy
LayerAuthorization

ALB unhealthy

Check firstHealth check
LayerApplication and network

Lambda timeout

Check firstLogs + dependency
LayerRuntime and dependency

API 502

Check firstLambda + response contract
LayerIntegration response

RDS timeout

Check firstNetwork + DB security group
LayerNetwork, authentication or configuration

VPC connection fails

Check firstPath analysis
LayerNetwork path

CLI resource missing

Check firstAccount + Region
LayerConfiguration

No logs

Check firstLogging configuration
LayerObservability

Fast triage

The 5-Minute AWS Debugging Checklist

  • Am I in the correct AWS account?
  • Am I in the correct Region?
  • What changed recently?
  • What identity or role is being used?
  • What exact error do I have?
  • Is DNS resolving?
  • Can traffic reach the destination?
  • Are security groups correct?
  • What do the logs show?
  • Are downstream services healthy?
  • Can I reproduce the failure?
  • Did the fix resolve the root cause?

Avoid these traps

Troubleshooting Habits That Make AWS Problems Worse

  1. Changing five things at once
  2. Granting AdministratorAccess to test
  3. Opening security groups to everyone
  4. Ignoring the exact error message
  5. Assuming AWS itself is broken first
  6. Ignoring the Region or account
  7. Fixing the symptom but not the cause
  8. Not documenting the incident

Transferable method

Think Like a Cloud Engineer

Observe the evidence, form a testable hypothesis, change one controlled variable, isolate the failing boundary, fix the cause, verify the result and document what you learned.

Think Like a Cloud Engineer
Observe
Hypothesize
Test
Isolate
Fix
Verify
Document

Learn → Build → Break → Troubleshoot → Improve → Document

Troubleshooting is one of the skills that turns AWS knowledge into practical cloud engineering ability. Use the AWS Cloud Engineer Roadmap 2026 to place it in your wider learning path, then intentionally debug the systems in 15 AWS Projects for Beginners. When certification supports that path, compare options in the AWS Certification Roadmap 2026.

Future deep dives can expand this playbook with AWS IAM Explained, AWS VPC Explained, EC2 vs Lambda, an AWS CloudOps Engineer Roadmap and a dedicated AWS CloudWatch Guide.

Build AWS Skills Beyond Tutorials

Troubleshooting gets easier when you have actually built the systems you are debugging. Explore YourCloudDude’s hands-on AWS projects and architecture resources.

Explore AWS Resources →

Direct answers

AWS Troubleshooting FAQ

What is the best way to troubleshoot AWS?

The best approach is to identify the broken layer, inspect recent changes and telemetry, trace the request, isolate one component, apply one fix and verify the result.

Why does AWS say AccessDenied?

AWS returns AccessDenied when the effective policy evaluation does not allow the requested action, or when an applicable policy explicitly denies it.

Why can I not connect to my EC2 instance?

First separate instance health from network reachability, then check the address, approved access path, route, security group, network ACL and SSH service.

How do I troubleshoot AWS networking?

Write down the source, destination, protocol and port, then trace every routing and security control between them.

What is VPC Reachability Analyzer?

VPC Reachability Analyzer is a static configuration-analysis tool that determines whether a configured network path is reachable and identifies a blocking component; it is not a packet generator.

Why does API Gateway return a 502 error?

With a Lambda integration, API Gateway can return 502 when the function runs but errors or when the proxy response does not match the required format.

What should I check when Lambda times out?

Check where execution time is spent, especially downstream calls, retries, VPC networking and resource usage, before increasing the timeout.

What AWS service should I use for logs?

Amazon CloudWatch Logs is the central log service for many AWS workloads, but the producing service or application must be configured and authorized to deliver the logs.

Is troubleshooting important for Cloud Engineers?

Yes. Cloud Engineers must be able to trace failures across identity, network, compute, application, data and observability layers instead of only deploying resources.

Technical references

Official AWS Documentation Used

AWS CloudOps · Troubleshooting

Deploying an AWS resource is only half the skill. The harder part begins when an instance cannot be reached, an API returns 502, an IAM request is denied or an application suddenly loses database connectivity.

This AWS troubleshooting guide is not a list of definitions or a collection of random fixes. It teaches a repeatable process for identifying the broken layer, tracing the request, testing one hypothesis at a time and proving the fix.

The objective is not to memorize every AWS error. It is to develop a CloudOps method you can reuse across EC2, IAM, S3, VPC, Lambda, API Gateway, RDS and load balancers.

Good troubleshooting is not guessing faster. It is eliminating possibilities systematically.

Quick answer

How Do You Troubleshoot an AWS Problem?

Read the exact symptom, identify the most likely layer, check recent changes and telemetry, trace the request, isolate one component, find the root cause, fix it, verify the behavior and prevent recurrence.

How Cloud Engineers Debug AWS
Read symptom
Identify layer
Recent changes
Metrics + logs
Trace request
Isolate
Root cause
Fix
Verify
Prevent
Jump to a failure

Request path

First Identify Which Layer Is Broken

A request usually crosses several layers. Do not begin by checking random services. Determine where the request stops, then investigate that boundary.

Trace the Request
User
DNS
Network
Load Balancer
Compute
Application
Database
Dependencies
IAM / SecurityMonitoringConfiguration
01

Failure 01 · EC2

EC2 Instance Is Running but SSH Times Out

Symptom

The instance is running, but an SSH connection to port 22 times out.

Most likely layer

Networking

Typical causes

  • Wrong Region or public address
  • Port 22 is not allowed from your trusted source
  • No internet-gateway route for the subnet
  • A network ACL or local firewall blocks the path
  • The SSH service or instance is not ready

Architecture

EC2 troubleshooting path
Laptop
Internet
Internet Gateway
Route Table
Security Group
EC2 :22

How to Diagnose It

  1. Confirm the account, Region, instance state and status checks.
  2. Confirm the intended connectivity model: public IPv4/IPv6, EC2 Instance Connect Endpoint, VPN, bastion or Systems Manager.
  3. For a public path, verify the address, attached internet gateway and the subnet route.
  4. Allow SSH only from the required trusted IP or network; do not open port 22 globally as a shortcut.
  5. Check network ACLs, the local/corporate firewall, the AMI user name and SSH service.
  6. Use VPC Reachability Analyzer when a configuration-path analysis will help isolate the blocking component.

Root cause example

The instance was healthy, but its subnet route table had no route to the attached internet gateway.

Fix

Restore the intended route or use the approved private-access method, then keep the security-group source narrowly scoped.

How to verify the fix

Reconnect using the correct address and user, confirm the host key, then test the application from the same approved path.

Prevent it next time

  • Use reviewed network templates
  • Prefer managed private access where practical
  • Document the approved connection path
02

Failure 02 · IAM

AWS Says “AccessDenied”

Symptom

An AWS API request is rejected with AccessDenied or not authorized.

Most likely layer

Identity and authorization

Typical causes

  • The active user or role is not the identity you expected
  • No applicable Allow grants the exact action and resource
  • An identity, resource, boundary, session or organization policy explicitly denies it
  • A policy condition does not match
  • The request uses the wrong role session context

Architecture

IAM troubleshooting path
User / Role
Policy Evaluation
Allow or Deny
AWS Resource

How to Diagnose It

  1. Capture the exact principal, action, resource ARN and error context.
  2. Run aws sts get-caller-identity when using the CLI or SDK.
  3. Review identity policies and the resource policy where the service supports one.
  4. Check permissions boundaries, session policies, service control policies and applicable conditions.
  5. Distinguish an implicit deny caused by no matching Allow from an explicit Deny, which wins over an Allow.

Root cause example

The application assumed a deployment role whose session policy omitted the required resource ARN.

Fix

Grant only the required action on the intended resource in the correct policy layer, or correct the role/session being used.

How to verify the fix

Repeat the same request as the same principal and confirm CloudTrail records the expected allowed action.

Prevent it next time

  • Use least-privilege policy reviews
  • Log the principal ARN in deployments
  • Test permission boundaries before release
03

Failure 03 · S3

S3 Returns 403 Access Denied

Symptom

An application can reach Amazon S3 but receives HTTP 403 for a bucket or object operation.

Most likely layer

Authorization

Typical causes

  • IAM or bucket policy does not allow the operation
  • An explicit deny or Block Public Access setting rejects the request context
  • Object ownership or cross-account context differs
  • A customer-managed KMS key policy lacks required access
  • A presigned URL is expired or signed for a different request

Architecture

S3 troubleshooting path
Application
IAM Role
S3 Authorization
Bucket / Object

How to Diagnose It

  1. Identify the caller with sts get-caller-identity and record the exact S3 action.
  2. Check the bucket ARN versus object ARN and review both identity and bucket policies.
  3. Inspect Object Ownership and any cross-account path.
  4. For SSE-KMS objects, verify the relevant KMS permissions and key policy.
  5. For presigned URLs, check expiry, method, headers, Region and the signer’s permissions.

Root cause example

The role could read the bucket, but the object used a customer-managed KMS key that the role could not decrypt.

Fix

Correct the narrowly scoped S3 and, when required, KMS permissions. Keep the bucket private unless public access is truly intended.

How to verify the fix

Repeat the exact object operation as the same role and confirm the correct object is returned without broadening public access.

Prevent it next time

  • Test the real runtime role
  • Standardize bucket ownership
  • Review S3 and KMS policies together
04

Failure 04 · ALB

Application Load Balancer Says Target Is Unhealthy

Symptom

A registered EC2 or ECS target fails the target group health check.

Most likely layer

Application and network

Typical causes

  • Health-check path does not exist
  • Health-check port differs from the listening port
  • The target security group blocks the load balancer
  • The service has not started or is bound to the wrong interface
  • The returned status code is outside the configured success matcher

Architecture

ALB troubleshooting path
Users
ALB
GET /health :8080
EC2 / ECS

How to Diagnose It

  1. Read the target health reason code before changing settings.
  2. Confirm protocol, port, path, timeout and success-code matcher.
  3. From inside the VPC, request the same path on the target’s private address and port.
  4. Verify the target security group allows the load balancer security group.
  5. Check application startup logs and confirm the process is listening on the expected interface and port.

Root cause example

The target group checked /health on port 8080, while the application listened on port 3000.

Fix

Align the target group health check with the application or correct the application listener, while preserving least-privilege security-group rules.

How to verify the fix

Wait for the healthy threshold, confirm the target becomes Healthy and make a request through the load balancer.

Prevent it next time

  • Expose a lightweight health endpoint
  • Keep app and infrastructure ports in one configuration source
  • Alert on healthy-host count
05

Failure 05 · Lambda

Lambda Function Times Out

Symptom

The function reaches its configured timeout before returning a response.

Most likely layer

Runtime and dependency

Typical causes

  • A downstream API or database is slow
  • A network call has no shorter client timeout
  • VPC routing, NAT or security rules block an outbound dependency
  • The workload needs more CPU or a different design
  • The function is waiting, retrying or processing too much in one invocation

Architecture

Lambda troubleshooting path
Event
Lambda
External Dependency
Response

How to Diagnose It

  1. Use the REPORT line and logs to find where duration is spent.
  2. Add timing around external calls and inspect the last successful log statement.
  3. Test downstream availability and configure explicit connection/read timeouts.
  4. If VPC-connected, check routes, security groups, DNS and NAT or service endpoints.
  5. Test memory settings because Lambda allocates CPU proportionally with memory, but do not treat more memory as a substitute for finding a blocked call.

Root cause example

A VPC-connected function called a public API from a private subnet with no working outbound path.

Fix

Restore the required network path or use an appropriate private endpoint, and set bounded client timeouts and retries.

How to verify the fix

Invoke with representative events, confirm duration stays below the timeout and verify the dependency receives the expected request.

Prevent it next time

  • Instrument dependency latency
  • Use bounded retries and timeouts
  • Alarm on errors, duration and throttles
06

Failure 06 · API

API Gateway Returns 502 Internal Server Error

Symptom

A client receives 502 from an API Gateway endpoint backed by Lambda.

Most likely layer

Integration response

Typical causes

  • The Lambda function ran but returned an error
  • The proxy response has the wrong shape or a non-string body
  • The function version or alias is not the one expected
  • Integration logging is incomplete
  • The integration contract differs from the deployed API

Architecture

API troubleshooting path
Client
API Gateway
Lambda
Response Contract

How to Diagnose It

  1. Capture the request ID and enable useful API access/execution logging for the API type.
  2. Open the corresponding Lambda log stream and locate the same request.
  3. Invoke the function with the API event shape.
  4. For a Lambda proxy integration, validate statusCode, headers, isBase64Encoded when used, and a string body.
  5. Distinguish invocation rejection, which can surface as 500, from a function error or malformed proxy response, which AWS documents as 502.

Root cause example

The function returned body as an object instead of a JSON string in a proxy response.

Fix

Return the response contract expected by the integration and handle application errors deliberately.

How to verify the fix

Call the deployed stage, confirm the intended HTTP status/body and correlate the request in API Gateway and Lambda logs.

Prevent it next time

  • Contract-test integration responses
  • Log request IDs
  • Deploy API and Lambda changes together
07

Failure 07 · RDS

Application Cannot Connect to RDS

Symptom

The application cannot establish or authenticate a database connection.

Most likely layer

Network, authentication or configuration

Typical causes

  • Wrong endpoint, port or database name
  • The DB security group does not allow the application security group
  • Subnet routing, peering or network ACLs block the path
  • The DB is unavailable or still starting
  • Credentials or secrets are wrong or stale

Architecture

RDS troubleshooting path
Application
App Security Group
VPC Path
DB Security Group
RDS

How to Diagnose It

  1. Classify the error: DNS failure, connection timeout/refused, TLS failure or authentication rejection.
  2. Confirm the current RDS endpoint, port, engine status and Region.
  3. Test DNS and TCP reachability from the application environment.
  4. Verify the DB security group allows the application security group or the required trusted source.
  5. Only after the network path works, verify the secret, database user, TLS mode and application connection string.

Root cause example

A new application security group was deployed, but the DB inbound rule still referenced the old group.

Fix

Restore the intended security-group relationship or correct the connection configuration and credentials.

How to verify the fix

Connect from the application runtime, run a harmless query and confirm the app’s connection-pool health.

Prevent it next time

  • Reference security groups rather than broad CIDRs
  • Monitor connections and DB availability
  • Rotate and test secrets safely
08

Failure 08 · VPC

Two AWS Resources Cannot Communicate Inside a VPC

Symptom

A source resource cannot reach a destination on a known protocol and port.

Most likely layer

Network path

Typical causes

  • The destination security group does not allow the source
  • A route is missing or points to the wrong target
  • A network ACL blocks the request or return path
  • The resources are in unconnected VPCs or overlapping networks
  • The destination service is not listening

Architecture

VPC troubleshooting path
Source
Source SG
Route
Subnet / NACL
Destination SG
Destination

How to Diagnose It

  1. Write down source, destination, protocol and port.
  2. Confirm the destination is listening and its address is current.
  3. Inspect security groups in both directions of the intended stateful flow.
  4. Trace route tables, peering/transit-gateway attachments and network ACL rules.
  5. Use VPC Reachability Analyzer to analyze configured reachability and identify a blocking component.

Root cause example

The destination security group allowed the old source CIDR but not the source instance’s security group.

Fix

Correct the narrow network control or route that breaks the intended path, then confirm the service is listening.

How to verify the fix

Test the exact protocol and port from the source and rerun the path analysis after the configuration change.

Prevent it next time

  • Document flows as source–destination–port
  • Review network changes
  • Use repeatable infrastructure definitions
09

Failure 09 · CLI

AWS CLI Shows No Resources but They Exist in the Console

Symptom

A list command returns no resources while the console shows them.

Most likely layer

Configuration

Typical causes

  • The CLI uses a different Region
  • The active profile belongs to another account
  • A different role is assumed
  • Environment credentials override the profile
  • A command filter excludes the resource

Architecture

CLI troubleshooting path
CLI Profile
Account
Region
List / Filter

How to Diagnose It

  1. Run aws sts get-caller-identity.
  2. Run aws configure list and inspect environment variables.
  3. Print the effective Region and compare it with the console.
  4. Retry without optional filters and confirm the service is regional or global as expected.

Root cause example

The console displayed Account A in us-east-1 while the CLI profile used Account B in eu-west-1.

Fix

Select the intended profile and Region explicitly, then remove or correct the filter.

How to verify the fix

Repeat the list command and compare the returned resource ID with the console.

Prevent it next time

  • Name profiles clearly
  • Show account and Region in shell prompts
  • Pass Region explicitly in automation
10

Failure 10 · Logs

The App Is Broken but CloudWatch Shows “Nothing”

Symptom

The application fails, but the expected CloudWatch log group or log events are empty.

Most likely layer

Observability

Typical causes

  • The wrong account, Region, log group or stream is open
  • Application or service logging is not configured
  • The delivery role lacks required log permissions
  • The request never reaches the expected code path
  • Retention or log routing removed or redirected the events

Architecture

Logs troubleshooting path
Application
Logging
CloudWatch Logs
Query / Alarm

How to Diagnose It

  1. Confirm account, Region, time range, log group and stream.
  2. Check whether the service must have logging enabled and whether the destination exists.
  3. Verify the execution or delivery role can create streams and put log events when those permissions are required.
  4. Add a known startup or request-boundary log and test again.
  5. Check metrics separately: metrics and logs are different signals, and one can exist without the other.

Root cause example

The application failed at the load balancer and never invoked the code path that emitted application logs.

Fix

Restore logging configuration or permissions, then instrument the earliest useful boundary in the request path.

How to verify the fix

Generate a controlled request and confirm a timestamped event, correlation ID and expected metric appear in the correct account and Region.

Prevent it next time

  • Provision logging with the workload
  • Use correlation IDs
  • Alert on missing expected telemetry

Save this

AWS Troubleshooting Cheat Sheet

SymptomCheck firstLikely layer
EC2 SSH timeoutNetwork path + security groupNetworking
AccessDeniedIAM evaluationIdentity and authorization
S3 403IAM + bucket policyAuthorization
ALB unhealthyHealth checkApplication and network
Lambda timeoutLogs + dependencyRuntime and dependency
API 502Lambda + response contractIntegration response
RDS timeoutNetwork + DB security groupNetwork, authentication or configuration
VPC connection failsPath analysisNetwork path
CLI resource missingAccount + RegionConfiguration
No logsLogging configurationObservability

EC2 SSH timeout

Check firstNetwork path + security group
LayerNetworking

AccessDenied

Check firstIAM evaluation
LayerIdentity and authorization

S3 403

Check firstIAM + bucket policy
LayerAuthorization

ALB unhealthy

Check firstHealth check
LayerApplication and network

Lambda timeout

Check firstLogs + dependency
LayerRuntime and dependency

API 502

Check firstLambda + response contract
LayerIntegration response

RDS timeout

Check firstNetwork + DB security group
LayerNetwork, authentication or configuration

VPC connection fails

Check firstPath analysis
LayerNetwork path

CLI resource missing

Check firstAccount + Region
LayerConfiguration

No logs

Check firstLogging configuration
LayerObservability

Fast triage

The 5-Minute AWS Debugging Checklist

  • Am I in the correct AWS account?
  • Am I in the correct Region?
  • What changed recently?
  • What identity or role is being used?
  • What exact error do I have?
  • Is DNS resolving?
  • Can traffic reach the destination?
  • Are security groups correct?
  • What do the logs show?
  • Are downstream services healthy?
  • Can I reproduce the failure?
  • Did the fix resolve the root cause?

Avoid these traps

Troubleshooting Habits That Make AWS Problems Worse

  1. Changing five things at once
  2. Granting AdministratorAccess to test
  3. Opening security groups to everyone
  4. Ignoring the exact error message
  5. Assuming AWS itself is broken first
  6. Ignoring the Region or account
  7. Fixing the symptom but not the cause
  8. Not documenting the incident

Transferable method

Think Like a Cloud Engineer

Observe the evidence, form a testable hypothesis, change one controlled variable, isolate the failing boundary, fix the cause, verify the result and document what you learned.

Think Like a Cloud Engineer
Observe
Hypothesize
Test
Isolate
Fix
Verify
Document

Learn → Build → Break → Troubleshoot → Improve → Document

Troubleshooting is one of the skills that turns AWS knowledge into practical cloud engineering ability. Use the AWS Cloud Engineer Roadmap 2026 to place it in your wider learning path, then intentionally debug the systems in 15 AWS Projects for Beginners. When certification supports that path, compare options in the AWS Certification Roadmap 2026.

Future deep dives can expand this playbook with AWS IAM Explained, AWS VPC Explained, EC2 vs Lambda, an AWS CloudOps Engineer Roadmap and a dedicated AWS CloudWatch Guide.

Build AWS Skills Beyond Tutorials

Troubleshooting gets easier when you have actually built the systems you are debugging. Explore YourCloudDude’s hands-on AWS projects and architecture resources.

Explore AWS Resources →

Direct answers

AWS Troubleshooting FAQ

What is the best way to troubleshoot AWS?

The best approach is to identify the broken layer, inspect recent changes and telemetry, trace the request, isolate one component, apply one fix and verify the result.

Why does AWS say AccessDenied?

AWS returns AccessDenied when the effective policy evaluation does not allow the requested action, or when an applicable policy explicitly denies it.

Why can I not connect to my EC2 instance?

First separate instance health from network reachability, then check the address, approved access path, route, security group, network ACL and SSH service.

How do I troubleshoot AWS networking?

Write down the source, destination, protocol and port, then trace every routing and security control between them.

What is VPC Reachability Analyzer?

VPC Reachability Analyzer is a static configuration-analysis tool that determines whether a configured network path is reachable and identifies a blocking component; it is not a packet generator.

Why does API Gateway return a 502 error?

With a Lambda integration, API Gateway can return 502 when the function runs but errors or when the proxy response does not match the required format.

What should I check when Lambda times out?

Check where execution time is spent, especially downstream calls, retries, VPC networking and resource usage, before increasing the timeout.

What AWS service should I use for logs?

Amazon CloudWatch Logs is the central log service for many AWS workloads, but the producing service or application must be configured and authorized to deliver the logs.

Is troubleshooting important for Cloud Engineers?

Yes. Cloud Engineers must be able to trace failures across identity, network, compute, application, data and observability layers instead of only deploying resources.

Technical references

Official AWS Documentation Used