VPC Network Access Analyzer
A security analysis tool that automatically analyzes network access paths across your entire VPC, detecting unintended internet exposure and excessive access permissions
Overview
VPC Network Access Analyzer is a service that analyzes network access paths within a VPC and automatically detects access routes that violate security policies. While Reachability Analyzer verifies reachability between two specific points, Network Access Analyzer targets the entire VPC to analyze which resources are accessible from where. You define Network Access Scopes and set detection conditions for access patterns that should not be permitted (e.g., direct internet access to databases). Findings display the specific access paths and the network components permitting them, enabling use in security audits and compliance checks.
Designing Network Access Scopes
Network Access Analyzer analysis begins with defining a Network Access Scope. Scopes consist of Match Paths and Exclude Paths, declaratively describing the access patterns you want to detect. Match conditions specify items such as source and destination resource types, CIDR blocks, and prefix lists. For example, specifying the source as Internet Gateway and the destination as ENIs within a specific subnet identifies potential paths from the internet to that subnet as findings. Exclude conditions remove intentionally permitted access paths (e.g., internet access via ALB) to reduce false positives. AWS-provided preset scopes are also available, letting you immediately start detecting patterns such as inbound access from the internet, outbound access to the internet, and access into and out of VPCs. Custom scopes are defined in JSON format, making them suitable for version control and code review.
Analyzing Findings and Remediation Actions
When analysis runs, access paths matching the scope are listed as Findings. Each finding displays the source resource, destination resource, and network components along the path (security groups, network ACLs, route tables, NAT Gateways, etc.) in detail. For example, a path like Internet Gateway, Route Table A, Subnet B, Security Group C, EC2 Instance D shows all hops permitting access. Remediation actions include removing security group inbound rules, adding network ACL deny rules, or removing routes from route tables. When findings are numerous, prioritize high-severity items (direct database access, exposed management ports) first. Another practice is incorporating findings into security team review workflows. Regularly re-running analysis and monitoring for new findings helps you notice security degradation from configuration drift.
Leveraging for Security Audits and Compliance
According to the user guide, Network Access Analyzer helps you demonstrate that your network on AWS meets your compliance requirements. PCI DSS requires strict access restrictions to the Cardholder Data Environment (CDE), and periodically verifying access paths to CDE subnets with Network Access Analyzer is one way to verify that requirement. For SOC 2 audits, it is one source of material for reviewing network segmentation. Note that the user guide states that the analysis covers network paths only within the account and Region from which you run it, and paths containing resources in other accounts or Regions are not reported (as of October 2026). Since analysis can be executed via API, one practice is automating monthly security report generation and tracking month-over-month changes in findings. For cost management, charges are based on the number of ENIs processed per analysis execution. Reachability Analyzer checks reachability between a specific source and destination, while Network Access Analyzer identifies unintended access paths against a scope.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon VPC official page
- AWS Security Hub official page
- AWS Config official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.