The web server web runs in public-a; its security group allows port 80, and it has an instance profile for Session Manager. A colleague gave the public subnets a network ACL of their own, and since then the page times out.

1. Put web's public IP in IP and try the page:

   sh

   copy

   IP=$(aws ec2 describe-instances --filters Name=tag:Name,Values=web --query "Reservations[0].Instances[0].PublicIpAddress" --output text)

   sh

   copy

   curl -m 3 http://$IP/

2. Keep public-a's id in SUBNET, then find the subnet's network ACL and keep its id in ACL.

3. Read its rules in both directions, in the order the ACL reads them, and fix what stops the page.

4. Curl the page again. If it says Connection refused instead of timing out, the firewall is no longer the problem: look inside web with a session.