AWS Network Manager
A service for centralized visualization and management of global networks
Overview
AWS Network Manager is a service that provides centralized visualization and management of your entire global network, including AWS network resources and on-premises locations. It aggregates network resources such as Transit Gateway, Site-to-Site VPN, Direct Connect, and Cloud WAN into a single dashboard, offering topology maps, route analysis, and network event monitoring. It simplifies network operations in multi-region, multi-account environments.
Global Networks and Core Networks
The central concept in Network Manager is the global network. A global network is a container that logically groups network resources across an organization, and multiple global networks can be created in a single AWS account. When you register a Transit Gateway with a global network, its attachments, such as VPCs, VPN connections, and Direct Connect gateways, are automatically included as managed resources. On-premises locations are registered as sites with physical location information (address, latitude/longitude), which displays them on a geographic topology map. Each site can be associated with devices (routers, firewalls, etc.) and links (circuit information) to document the site's network configuration. When using Cloud WAN, a core network is created within the global network, where you define traffic isolation by segment and inter-region connectivity policies. The core network policy document is written in JSON format and supports version control.
Topology Visualization and Route Analysis
The Network Manager console displays the connectivity relationships of registered resources as an interactive topology map. According to the user guide, the dashboard can help you identify whether issues in your network are caused by AWS resources, on-premises resources, or the connections between them. The route analysis feature analyzes the routing path between a specified source and destination, displaying each hop along the path and the route table entries. It is used to verify transit gateway route table configurations and diagnose route-related issues, and it does not analyze VPC route tables, security group rules, or network ACL rules. Integration with CloudWatch metrics enables monitoring of Transit Gateway byte counts, packet counts, and drop counts, with alarms to detect traffic anomalies. Network events (VPN tunnel down, BGP peering state changes, etc.) are published to EventBridge, enabling automated notification and recovery workflows through Lambda and SNS integration.
Cloud WAN Integration and Policy Management
Cloud WAN is a global wide-area network service built on top of Network Manager, operated directly from the Network Manager console. Core network policies define segments (production, development, shared services, etc.) and declaratively manage inter-segment communication allow/deny rules as policies. Attachments such as VPCs, VPNs, and Direct Connect are connected, with each attachment assigned to a segment. Policy changes are saved as versions, and a change set shows the proposed changes before they are deployed. Attachment policies can automatically map attachments to segments based on conditions such as tags, and a setting can require approval from the core network owner for the mapping. Cloud WAN pricing is usage-based, calculated from factors such as the number of core network edges, attachments, and data processing volume.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Transit Gateway official page
- AWS Direct Connect official page
- Amazon VPC official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.