You are an architect in your organization. One of the application team in your organization comes to you stating recently they noticed the requests sending from an EC2 instance to an RDS in the same VPC but in another subnet are getting timed out. They claim that connections were working before. How do you troubleshoot this issue?

Answer options:

A.Create VPC flow log for subnet where RDS instance is launched.
B.Check CloudWatch metrics for RDS instance.
C.Check OS level logs inside RDS instance.
D.Check OS level logs inside EC2 instance.

Answer: A
For option A, VPC Flow Logs captures IP traffic going to and from network interfaces in your VPC. Flow log data is stored using Amazon CloudWatch Logs. After you`ve created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs.
You can create a flow log for a VPC, a subnet, or a network interface. 
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html#flow-logs-basics
VPC Flow Logs capture following information and logs them to CloudWatch logs,
version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status
Find more information about each record here.
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html#flow-log-records
So, using VPC flow logs, we can identify if the traffic is being rejected by RDS instance when sent from the EC2 instance on a certain port. From there on, we can identify if there any overly restrictive Security Group rules or Network ACL rules.
For option B, CloudWatch metrics for RDS gives the details about RDS underlying database instance metrics. But this does not contain details about networking requests sent to RDS instance.
For more information on CloudWatch metrics for RDS, refer documentation here.
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/rds- metricscollected.html
For option C, RDS underlying OS is managed by AWS and cannot be accessed by AWS customers.
For option D, enabling OS level logs at the EC2 instance where the request is being made does not provide any information on why the request is being timed out at RDS instance.
So, the correct answer is option A.