Cloud network reachability analysis for virtual private clouds

A system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
• receiving, from a user device, a reachability request requesting a reachability status of network traffic from a first virtual machine (VM) of a virtual private cloud (VPC) to a second VM of the VPC;
• obtaining network configuration information defining a configuration of a network connecting the first VM and the second VM;
• generating, using the network configuration information, a simulated path between the first VM and the second VM;
• determining, based on the simulated path, that the second VM is unreachable from the first VM;
• and
• based on determining that the second VM is unreachable from the first VM, generating a reachability report, the reachability report comprising:
• a list of each hop of the simulated path, wherein the list identifies, based on the network configuration information, a matching egress firewall rule applied by the first VM during the simulated path and a matching ingress firewall rule applied by the second VM during the simulated path;
• and
• a rationale that the second VM is unreachable from the first VM;
• and
• providing the reachability report to the user device.