Inspecting the VPC

# List VPCs by environment tag
aws ec2 describe-vpcs \
  --filters "Name=tag:Environment,Values=qa" \
  --query 'Vpcs[*].{VpcId:VpcId,CIDR:CidrBlock,State:State}'

# List subnets in a VPC
aws ec2 describe-subnets \
  --filters "Name=vpc-id,Values=<vpc-id>" \
  --query 'Subnets[*].{SubnetId:SubnetId,AZ:AvailabilityZone,CIDR:CidrBlock}'

# Confirm no Internet Gateway is attached
aws ec2 describe-internet-gateways \
  --filters "Name=attachment.vpc-id,Values=<vpc-id>"
# Expected: empty Attachments array

# Confirm no NAT Gateways in the VPC
aws ec2 describe-nat-gateways \
  --filter "Name=vpc-id,Values=<vpc-id>"
# Expected: empty, or only entries in deleted state

# Inspect Aurora security group inbound rules
aws ec2 describe-security-groups \
  --filters "Name=vpc-id,Values=<vpc-id>" \
  --query 'SecurityGroups[*].{GroupId:GroupId,Name:GroupName,Ingress:IpPermissions}'

# Confirm no VPC endpoints provisioned
aws ec2 describe-vpc-endpoints \
  --filters "Name=vpc-id,Values=<vpc-id>"
# Expected: empty

To confirm that no public path exists to the Aurora cluster: in the AWS Console, go to VPC > Reachability Analyzer. Because no Internet Gateway is attached, an analysis sourced from an internet gateway cannot be constructed. The more informative check is to verify that Lambda has no ENI inside the VPC:

aws lambda get-function-configuration \
  --function-name rag-sample-<env>-api \
  --query 'VpcConfig'
# Expected: null or empty SubnetIds and SecurityGroupIds