AWS Network Manager
A service for centralized visualization and management of global networks
Overview
AWS Network Manager is a service that provides centralized visualization and management of your entire global network, including AWS network resources and on-premises locations. It aggregates network resources such as Transit Gateway, Site-to-Site VPN, Direct Connect, and Cloud WAN into a single dashboard, offering topology maps, route analysis, and network event monitoring. It dramatically simplifies network operations in multi-region, multi-account environments.
Global Networks and Core Networks
The central concept in Network Manager is the global network. A global network is a container that logically groups all network resources across an organization, and multiple global networks can be created in a single AWS account. When you register a Transit Gateway with a global network, its associated VPCs, VPN connections, and Direct Connect gateways are automatically included as managed resources. On-premises locations are registered as sites with physical location information (address, latitude/longitude), which displays them on a geographic topology map. Each site can be associated with devices (routers, firewalls, etc.) and links (circuit information) to document the site's network configuration. When using Cloud WAN, a core network is created within the global network, where you define traffic isolation by segment and inter-region connectivity policies. The core network policy document is written in JSON format and supports version control.
Topology Visualization and Route Analysis
The Network Manager console displays the connectivity relationships of registered resources as an interactive topology map. The connection status of regions, Transit Gateways, VPCs, VPNs, and Direct Connect is reflected in real time, allowing you to immediately identify which paths are affected during an outage. The route analysis feature analyzes the routing path between a specified source and destination, displaying each hop along the path and the route table entries. When a route does not exist or a blackhole route is detected, it pinpoints the cause. Integration with CloudWatch metrics enables monitoring of Transit Gateway byte counts, packet counts, and drop counts, with alarms to detect traffic anomalies. Network events (VPN tunnel down, BGP peering state changes, etc.) are published to EventBridge, enabling automated notification and recovery workflows through Lambda and SNS integration.
Cloud WAN Integration and Policy Management
Cloud WAN is a global wide-area network service built on top of Network Manager, operated directly from the Network Manager console. Core network policies define segments (production, development, shared services, etc.) and declaratively manage inter-segment communication allow/deny rules as policies. Attachments connect VPCs, VPNs, Direct Connect, and Transit Gateway peerings, with each attachment assigned to a segment. Policy changes are saved as versions, and a dry run can verify the impact before applying changes. Integration with Organizations enables an auto-accept feature that automatically connects member account VPCs to the core network. Pricing is usage-based, calculated from the number of core network edge locations, attachments, and data processing volume. While costs are higher compared to a standalone Transit Gateway configuration, for networks spanning dozens of regions and hundreds of VPCs, the operational cost savings from policy-based centralized management outweigh the additional expense.