Troubleshooting DiscrimiNAT on AWS

Описание: Here's how to troubleshoot DiscrimiNAT, using the logs and cloud tools, to make your egress filtering journey a smooth one.

Ensure these environment variables are set:
export IP=

Command 1:

aws logs filter-log-events --output json --no-paginate --log-group-name DiscrimiNAT --log-stream-names flow --filter-pattern '{$.dhost != "" && $.src = "'$IP'"}' --start-time $(date --date '2 hours ago' +%s000) | jq '[.events[].message | fromjson]'

Command 2:

aws logs filter-log-events --output json --no-paginate --log-group-name DiscrimiNAT --log-stream-names flow --filter-pattern '{$.outcome = "disallowed" && $.src = "'$IP'"}' --start-time $(date --date '2 hours ago' +%s000) | jq '[.events[].message | fromjson]' | jq --raw-output 'group_by(.dhost)| map(.[0]) | [.[].dhost] | @csv' | tr --delete '"'

Note: You may need to adjust the --start-time parameter to extend the time range to more than 2 hours ago. It could be set to, for example, 7 days ago.