A single AWS Security Group change silently broke a healthy application

A developer discovered that modifying one egress rule in an AWS Security Group caused their EC2 application to lose connectivity to its database, despite all instances appearing healthy. No deployment had occurred, and CPU metrics were normal — the only symptom was a connection timeout. The root cause was an accidental restriction on outbound traffic from the application's Security Group, which severed the return path for database connections. Although AWS Security Groups are stateful, an overly restrictive egress rule can still block traffic at the network policy level without triggering any health alerts. The incident highlighted that cloud debugging must go beyond server status checks to examine port-level, directional, and path-specific network permissions.