Network Topology Visualization

What is Network Topology?

Network Topology is CloudWrangler's interactive visualization of your AWS VPC infrastructure. It shows all your networking components and how they connect, making it easy to understand your cloud network architecture at a glance.

Unlike the Infrastructure Diagram (which shows resources and traffic flows), Network Topology focuses specifically on the networking layer: VPCs, subnets, gateways, and connections.

Overview

Network Topology helps you:

• Understand VPC Architecture: See how your VPCs are structured
• Verify Network Design: Ensure resources are in the right subnets
• Troubleshoot Connectivity: Identify routing and gateway issues
• Document Infrastructure: Generate up-to-date network diagrams
• Plan Changes: Visualize network before making changes
• Audit Security: Review public vs private subnet placement

What You Can See

VPC Components

• VPCs: All VPCs with CIDR blocks and names
• Subnets: Public and private subnets with AZ distribution
• Internet Gateways: IGW attachments to VPCs
• NAT Gateways: Public/private IP addresses and state
• VPC Endpoints: Interface and Gateway endpoints with service names
• Route Tables: Routing configuration per subnet

Connectivity

• VPC Peering: Active peering connections between VPCs
• Transit Gateway: TGW attachments with state
• VPN Gateways: Site-to-site VPN connections
• Direct Connect: DX gateways and virtual interfaces

Discovery Process

Before you can view Network Topology, CloudWrangler must discover your networking components.

How CloudWrangler Maps Your Network

When you connect an AWS account, CloudWrangler automatically:

1. Discovers VPCs

   • Scans all enabled regions
   • Identifies all VPCs
   • Retrieves CIDR blocks and tags
   • Maps VPC relationships

2. Maps Subnets

   • Lists all subnets in each VPC
   • Identifies availability zones
   • Classifies as public or private
   • Collects CIDR blocks

3. Identifies Gateways

   • Internet Gateways (IGWs)
   • NAT Gateways
   • Virtual Private Gateways (VGWs)
   • Transit Gateways
   • VPC Endpoints

4. Analyzes Route Tables

   • Retrieves all route tables
   • Maps subnet associations
   • Identifies routes to gateways
   • Determines subnet classification

5. Discovers Connections

   • VPC Peering connections
   • Transit Gateway attachments
   • VPN connections
   • Direct Connect gateways

Discovery Time: 30-60 seconds per region

Automatic Refresh: Every 12 hours

What Resources Are Discovered

VPC Components:

• VPCs and their CIDR blocks
• Subnets and availability zones
• Route tables and routes
• Network ACLs
• Security groups (referenced)

Gateways:

• Internet Gateways
• NAT Gateways (including EIPs)
• Egress-Only Internet Gateways
• VPC Endpoints (Gateway and Interface)
• Virtual Private Gateways

Connections:

• VPC Peering Connections
• Transit Gateway Attachments
• VPN Connections
• Direct Connect Virtual Interfaces

Metadata:

• All resource tags
• Creation timestamps
• State information
• Cost allocation data

Viewing the Topology

Accessing the Topology

1. Navigate to Network Topology in the sidebar
2. Select an AWS account from the dropdown
3. Choose a region (or "All Regions")
4. The diagram renders automatically

Interactive Diagram Features

Zooming and Navigation:

• Mouse wheel: Zoom in/out
• Click and drag: Pan around the diagram
• Double-click node: Center and zoom on that component
• Fit to screen: Button to reset view

Selecting Components:

• Click any node: View detailed information
• Hover: See quick tooltip
• Right-click: Context menu with actions

Visual Filtering:

• Filter by region
• Filter by VPC
• Show/hide specific component types
• Search by name or ID

Understanding the Diagram

Visual Layout:

The diagram uses a hierarchical layout:

• Top Level: VPCs are the main containers
• Second Level: Gateways and connections
• Third Level: Subnets within VPCs
• Connections: Lines showing relationships

Color Coding:

Icons and Symbols:

• Cloud icon: VPC
• Router icon: Route table
• Shield icon: Security group
• Lock icon: Private subnet
• Globe icon: Public subnet
• Arrows: Traffic direction

Resource Details

Click on any component to see:

VPC Details:

• VPC ID and name
• CIDR block(s)
• Default VPC indicator
• Number of subnets
• Associated route tables
• Tags

Subnet Details:

• Subnet ID and name
• CIDR block
• Availability zone
• Public/private classification
• Associated route table
• Number of ENIs
• Available IP addresses

Gateway Details:

• Gateway ID and type
• State (available, attached)
• Associated VPC
• Public IP (for NAT Gateway)
• Elastic IP (for NAT Gateway)
• Created timestamp

Connection Details:

• Connection ID
• Type (peering, TGW, VPN)
• Status (active, pending)
• Source and destination
• CIDR blocks allowed

Subnet Classification

CloudWrangler automatically classifies subnets as public or private based on route tables:

Public Subnet:

• Has a route to an Internet Gateway (0.0.0.0/0 → igw-xxx)
• Can receive inbound traffic from the internet
• Typically hosts load balancers, bastion hosts

Private Subnet:

• No direct route to Internet Gateway
• May route through NAT Gateway for outbound only
• Typically hosts application servers, databases

Traffic Path Analysis

CloudWrangler's Network Analyzer helps you understand connectivity between resources.

Analyzing Connectivity Between Resources

The Network Analyzer shows you:

Path Visualization:

• Route from source to destination
• All hops along the path
• Gateways and route tables involved
• Potential bottlenecks

Security Group Analysis:

• Inbound rules at destination
• Outbound rules at source
• Which rules allow/deny traffic
• Implicit denies

Route Table Verification:

• Routes that apply to the traffic
• Next hop for each route
• Potential routing issues
• Missing routes

Connection Status:

• Will traffic be allowed?
• Which security group rule applies?
• Are there any blocking NACLs?
• What's the complete path?

Using Network Analyzer

Step 1: Select Source

• Choose source resource (EC2 instance)
• Or enter source IP address
• Select source subnet if needed

Step 2: Select Destination

• Choose destination resource (RDS, EC2, etc.)
• Or enter destination IP address
• Select destination port

Step 3: Analyze Path

• CloudWrangler traces the path
• Shows each hop
• Highlights security group rules
• Identifies issues

Step 4: Review Results

• Green: Traffic will be allowed
• Red: Traffic will be blocked
• Yellow: Potential issues
• Details show why

Use Case: Troubleshooting Database Connection

Scenario: Application can't connect to database

Steps:

1. Open Network Analyzer
2. Source: Application server (10.0.1.50)
3. Destination: RDS database (10.0.2.100:5432)
4. Click "Analyze Path"

Results Show:

• Route table allows traffic to subnet
• Security group blocks port 5432
• Fix: Add inbound rule for port 5432 from app subnet

Implementation:

1. Click "View Security Group in AWS Console"
2. Add the recommended rule
3. Re-test connection
4. Connection succeeds

Use Cases

Use Case 1: Architecture Review

Scenario: New team member needs to understand the network architecture.

How to Use Network Topology:

1. Open Network Topology for the production account
2. View the VPC structure
3. Identify public vs private subnets
4. Locate NAT Gateways and endpoints
5. Export diagram for documentation

Benefits: Visual, up-to-date architecture documentation.

Use Case 2: Security Audit

Scenario: Compliance requires documenting public subnets.

How to Use:

1. View Network Topology
2. Filter to show only public subnets (green)
3. List resources in each public subnet
4. Verify only authorized resources are public
5. Export for compliance report

Benefits: Quick identification of internet-facing infrastructure.

Use Case 3: High Availability Verification

Scenario: Ensure production is deployed across multiple AZs.

How to Use:

1. View Network Topology
2. Look at subnet distribution
3. Verify resources in multiple AZs
4. Check NAT Gateway redundancy
5. Identify single points of failure

Benefits: Visual HA validation.

Use Case 4: Cost Optimization

Scenario: Reduce NAT Gateway costs.

How to Use:

1. View Network Topology
2. Identify NAT Gateways
3. Check for VPC endpoints (cheaper)
4. See which subnets route to NAT
5. Plan endpoint deployment

Benefits: Identify opportunities to replace NAT Gateway with endpoints.

Use Case 5: Connectivity Troubleshooting

Scenario: Resources can't communicate.

How to Use:

1. Use Network Analyzer
2. Select source and destination
3. Analyze the path
4. Review security groups and routes
5. Identify the blocking rule

Benefits: Faster troubleshooting than manually checking AWS Console.

Use Case 6: Planning Infrastructure Changes

Scenario: Adding a new subnet for a new application.

How to Use:

1. View existing Network Topology
2. Identify available CIDR space
3. Determine public vs private requirement
4. Plan route table associations
5. Document the change

Benefits: Visualize before implementing.

Best Practices

CloudWrangler helps you follow AWS networking best practices:

Multi-AZ Deployment

Best Practice: Deploy across multiple availability zones for high availability.

How Network Topology Helps:

• Quickly see subnet distribution across AZs
• Identify single-AZ resources
• Verify redundancy

What to Look For:

• At least 2 subnets per application (one per AZ)
• NAT Gateways in multiple AZs
• Load balancers spanning AZs

Public/Private Separation

Best Practice: Keep application servers in private subnets.

How Network Topology Helps:

• Visual distinction (green vs orange)
• Easy identification of public resources
• Route table verification

What to Look For:

• Databases in private subnets (orange)
• Application servers in private subnets
• Only load balancers in public subnets (green)

NAT Gateway High Availability

Best Practice: Deploy one NAT Gateway per availability zone.

How Network Topology Helps:

• Shows NAT Gateway locations
• Identifies single NAT configurations
• Validates redundancy

What to Look For:

• One NAT Gateway per AZ
• Each private subnet routes to AZ-local NAT
• No cross-AZ NAT routing (expensive)

VPC Endpoint Usage

Best Practice: Use VPC endpoints to avoid NAT Gateway costs.

How Network Topology Helps:

• Shows existing endpoints
• Identifies opportunities for new endpoints
• Documents endpoint configuration

Common Endpoints to Deploy:

• S3 Gateway Endpoint (free)
• DynamoDB Gateway Endpoint (free)
• EC2 Interface Endpoint
• ECR Interface Endpoint

VPC Peering vs Transit Gateway

How Network Topology Helps:

• Visualizes peering mesh complexity
• Shows Transit Gateway hub-and-spoke architecture
• Helps understand your connectivity design

Refreshing Data

Network Topology data is kept up-to-date automatically:

Automatic Refresh:

• Every 12 hours
• Scheduled background job
• Covers all enabled regions

Manual Refresh:

1. Click account dropdown
2. Select "Refresh Resources"
3. Wait 30-60 seconds per region
4. Topology updates automatically

When First Added:

• Immediate discovery on account connection
• Takes 1-2 minutes for full scan
• All regions scanned in parallel

What Triggers Re-Discovery:

• Manual refresh request
• Scheduled 12-hour interval
• After AWS account credentials update

Exporting and Sharing

Share Network Topology with your team:

Export Options:

• Screenshot: Use browser screenshot or snipping tool
• Print to PDF: Browser print function
• Export Data: JSON export of topology data

Sharing:

• Share CloudWrangler link with team members
• Export and include in documentation
• Use in architecture presentations

Limitations

Current Limitations:

• Shows configured topology only (not actual traffic without Flow Logs)
• Some older VPC features may not be visualized
• Very large VPCs (100+ subnets) may be slow to render
• Real-time changes take up to 12 hours to appear (or manual refresh)

Not Shown:

• Instance-level security groups (shown in Infrastructure Diagram)
• Individual EC2 instances (use Infrastructure Diagram)
• Traffic volumes (use Infrastructure Diagram with Flow Logs)
• Resource health status

Performance:

• Large environments may take longer to render
• Use region filtering for better performance
• Chrome/Edge recommended for best experience

Next Steps

Frequently Asked Questions

Q: What's the difference between Network Topology and Infrastructure Diagram? A: Network Topology shows VPC architecture (subnets, gateways, routes). Infrastructure Diagram shows resources (EC2, RDS) and traffic flows.

Q: Do I need VPC Flow Logs for Network Topology? A: No, Network Topology works without Flow Logs. Flow Logs are only needed for traffic visualization in Infrastructure Diagram.

Q: How often is the topology updated? A: Automatically every 12 hours, or manually anytime.

Q: Can I export the diagram? A: Yes, use browser screenshot, print to PDF, or export topology data as JSON.

Q: Why is my new subnet not showing? A: Click "Refresh Resources" to trigger immediate discovery, or wait up to 12 hours for automatic refresh.

Q: What does "public subnet" mean? A: A subnet with a route table that routes 0.0.0.0/0 to an Internet Gateway.

Q: Can I see route table details? A: Yes, click on any subnet to see its associated route table and routes.

Q: Does Network Topology show security groups? A: It shows security group associations but not detailed rules. Use Network Analyzer for security group analysis.

Q: Can I filter to specific VPCs? A: Yes, use the VPC filter in the interface to show only selected VPCs.

Q: What if I have 100+ subnets? A: Use filtering to show subsets. Very large VPCs may render slowly.

Q: Can I see Transit Gateway routing? A: Yes, Transit Gateway attachments and routing are shown in the topology.

Q: Does it work with multi-region? A: Yes, you can view all regions or filter to specific regions.