A critical application runs on EC2 instances behind an Application Load Balancer and must always be reachable on port 443 from the public internet. An outage occurred after an incorrect change to an EC2 security group. The network engineer needs an automated way to verify connectivity from the internet to the EC2 instances whenever the security group changes and to notify when connectivity is affected. Which solution satisfies these requirements?

The correct solution uses VPC Reachability Analyzer, which is designed to analyze network reachability between specified source and destination resources, including paths through security groups and Network ACLs. By setting the Internet Gateway as the source and the EC2 instances as the destination, it accurately simulates public internet connectivity. An EventBridge rule can trigger a Lambda function on security group changes, which then runs Reachability Analyzer and sends an SNS notification if the path becomes unreachable. VPC Flow Logs (options 1 and 2) only record actual traffic that reaches the ENI, not potential reachability. If a security group change blocks traffic, Flow Logs won't show rejected traffic because the traffic never reaches the ENI to be rejected; it's dropped earlier. Option 3 incorrectly specifies the security group as the source for Reachability Analyzer; Reachability Analyzer needs a network interface or IP address as a source to simulate traffic flow.