AWS VPC, Subnets, and Security Groups

You are a Architect on-call. A production issue might involve AWS VPC, Subnets, and Security Groups. How do you diagnose and mitigate?

Answers use simple, clear English.