Netway — Cloud Network Intelligence

What is Netway?

Netway is a lightweight AWS Lambda that runs inside your own AWS account. On every daily scan it does two things: maps your VPC topology (VPCs, Transit Gateways, peerings, internet gateways, NAT gateways, subnets, compute instances) and analyses VPC Flow Logs for network cost waste. Results are sent to the Netway service where detectors run server-side.

Netway gives you three capabilities from a single deployment:
• Network Topology — interactive graph of your entire AWS network across all accounts and regions.
• Compliance — isolation rule enforcement with 365-day history and one-click PDF evidence report for PCI-DSS and SOC2 audits.
• Cost — detection of avoidable network spend (S3 via NAT, cross-AZ traffic, and more) with dollar amounts and exact fix commands.

Your raw VPC Flow Log data and network traffic never leave your AWS account — only aggregated topology metadata and traffic summaries are transmitted.

Key facts

• Deploys in 3–5 minutes via a single CloudFormation command — works in any AWS region
• You choose which VPCs to monitor — no surprises, no implicit permissions creep
• Runs on a daily schedule and on new resource creation
• Costs ~$0.02 per scan in Athena + Lambda fees
• Read-only access to your EC2, RDS, and networking resources — Netway never modifies your existing infrastructure; the only write access granted is to the S3 bucket and Athena workgroup the stack creates for itself (full IAM policy)
• Raw network data never leaves your AWS account
• Three capabilities in one deploy: topology graph, compliance evidence, cost optimisation
• 14-day free trial, no credit card required

How it works

Each daily scan follows these steps inside your account:

1. At deploy time, enable VPC Flow Logs on your specified VPCs → S3 bucket in your region
2. On each scan, collect VPC topology — VPCs, Transit Gateways, peerings, subnets, route tables, EC2 instances
3. Evaluate isolation rules against the topology graph — check whether any network path exists between selected environment group pairs
4. Run topology detectors — CIDR conflicts, orphaned VPCs, CDE internet exposure, missing TGW propagations
5. Query flow logs from S3 using Athena (data never leaves your account)
6. Map IP addresses to your AWS resources (EC2, RDS, SageMaker, NAT Gateways)
7. Classify each flow by traffic type (S3, internet, cross-AZ, ML, etc.)
8. Aggregate flows into compact summaries and ship them to the Netway service (raw logs stay in your account)
9. Topology detectors evaluate isolation rules, check for CIDR conflicts, CDE exposure, and other compliance issues. Cost detectors identify wasteful traffic patterns and estimate monthly savings.
10. Findings appear in your Netway dashboard — topology graph, compliance status, and cost findings with one-command fixes

What it detects

Topology & Compliance

Netway evaluates your network topology for compliance and security issues on every scan:

• Isolation rule violations — production↔staging, CDE↔internet, and any custom rule you define
• CDE internet exposure — VPC tagged as cardholder data environment with a direct internet gateway
• CIDR conflicts — overlapping CIDR blocks across VPCs that will cause routing failures
• Orphaned VPCs — VPCs with no peering, TGW attachment, or internet gateway
• Missing TGW route propagation — Transit Gateway attachments with incomplete route tables
• Environment group mismatches — resources tagged inconsistently within the same VPC

Network Cost

Netway detects avoidable AWS network spend from VPC flow logs:

Step 1 — Register

Register to get your API key. You can do this from the homepage or via curl.

aws sts get-caller-identity --query Account --output text

curl -X POST https://api.basavytix.com/netway/v1/register \
  -H 'Content-Type: application/json' \
  -d '{"email": "you@company.com", "aws_account_id": "123456789012"}'

Step 2 — Install

Netway deploys into your AWS account via a single CloudFormation command. Deploy it in the same region as the VPCs you want to scan — Netway creates its own S3 bucket and Athena workgroup there, and enables VPC Flow Logs on exactly the VPCs you specify.

aws ec2 describe-vpcs \
  --query 'Vpcs[*].{Id:VpcId,Name:Tags[?Key==`Name`].Value|[0],CIDR:CidrBlock}' \
  --output table \
  --region YOUR_REGION

curl https://api.basavytix.com/netway/v1/install \
  -H 'x-api-key: YOUR_API_KEY'

./netway-deploy.sh deploy \
  --api-key YOUR_API_KEY \
  --regions YOUR_REGION

./netway-deploy.sh status

IAM permissions

The CloudFormation stack creates one IAM role for the scanning Lambda (netway-analyzer-<region>), scoped to the minimum permissions the scan needs. Netway follows the principle of least privilege: every action below exists because a specific scan step needs it, and nothing broader is granted. The role can only be assumed by the Lambda service itself (lambda.amazonaws.com) — there is no cross-account trust relationship, and the role is not assumable from outside your own account.

What the role can do

Netway never requests any :Create, :Modify, :Delete, or :Put action against your existing EC2, RDS, networking, or compute resources. The only write actions in the entire policy (s3:PutObject, the Glue/Athena create-table/create-database calls, and the log-group writes) target resources the stack itself creates and owns — never resources you already had.

Step 3 — Run a scan

Netway scans automatically on a daily schedule and whenever a new EC2 instance, VPC, or NAT Gateway is created. Each regional stack runs its own Lambda — in a multi-region setup, each region scans independently and posts results to the same dashboard. To trigger a scan manually:

aws lambda invoke \
  --function-name netway-analyzer \
  --region YOUR_REGION \
  /tmp/out.json && cat /tmp/out.json

# Trigger scans across all deployed regions at once
./netway-deploy.sh scan

# Wait for results and show findings summary per region
./netway-deploy.sh scan --wait

aws logs tail /aws/lambda/netway-analyzer --region YOUR_REGION --since 1h

Step 4 — View findings

Once a scan completes, findings appear in your dashboard and can also be fetched via the API.

# Cost findings
curl https://api.basavytix.com/netway/v1/cost/dashboard \
  -H 'x-api-key: YOUR_API_KEY'

# Topology graph
curl https://api.basavytix.com/netway/v1/topology/graph \
  -H 'x-api-key: YOUR_API_KEY'

Topology Graph

After your first scan the Topology tab in the dashboard shows an interactive force-directed graph of your entire AWS network. VPCs, Transit Gateways, Internet Gateways, and NAT Gateways are shown as AWS Architecture Icons.

The graph shows reachability between VPCs visually. Click any VPC node to open the sidebar — showing CIDR blocks, environment group, finding count, and compute instances within each subnet. Switch to the Matrix panel to see a full reachability grid across all VPC pairs. Use the pill switcher at the top to navigate between Graph, Matrix, CIDR Map, and History panels.

Isolation Rules

Isolation rules define network boundaries that must be maintained. Netway evaluates each rule on every scan and records a pass/fail result with a timestamp — building an immutable 365-day audit log.

Create rules from the Compliance tab in the dashboard: choose two environment groups (e.g. production and staging) and Netway will alert you immediately if a route between them is ever detected.

Compliance Report

The compliance evidence report is generated on demand from the Compliance tab. Choose a date range and click Download HTML or Download PDF. The report covers your isolation rule history, topology findings, network diagram, traffic flows, and change log for the selected period.

Every report is signed with HMAC-SHA256 using your customer API key — the signature is embedded in the report header and can be independently verified. Hand the PDF directly to your QSA as PCI-DSS or SOC2 evidence.

Multi-region deployment

For multiple regions, use netway-deploy.sh — a single script that deploys, updates, scans, and removes Netway across all your regions in parallel. Each region gets its own independent Lambda, S3 bucket, and Athena workgroup, all reporting to the same dashboard.

curl -O https://netway-public-releases.s3.ap-south-1.amazonaws.com/netway-deploy.sh
chmod +x netway-deploy.sh

./netway-deploy.sh deploy \
  --api-key YOUR_API_KEY \
  --regions us-east-1,eu-west-1,ap-south-1

# Fire and forget
./netway-deploy.sh scan

# Wait for results with per-region findings summary
./netway-deploy.sh scan --wait

./netway-deploy.sh status

./netway-deploy.sh update

./netway-deploy.sh delete --regions eu-west-1

Multi-account setup

To monitor VPCs across multiple AWS accounts, deploy one Netway stack per account using the same API key. No cross-account IAM trust or management account access is required — each stack operates entirely within its own account.

# Deploy into account B using a named AWS CLI profile
./netway-deploy.sh deploy \
  --api-key YOUR_API_KEY \
  --regions YOUR_REGION \
  --profile staging-account

# Scan a single account
./netway-deploy.sh scan --profile staging-account

# Scan multiple accounts in parallel
./netway-deploy.sh scan --profile prod-account --profile staging-account

Slack Notifications

Netway can post a rich summary of every scan directly to a Slack channel — showing the total monthly waste, quick wins, and top findings with severity and fix actions. Compliance violation alerts (isolation rule failures) are also sent to the same Slack channel immediately on detection — not as part of the scan summary, but as real-time alerts.

Configuration takes about 2 minutes. You only need to create a Slack Incoming Webhook URL (no bot token, no app store listing required) and save it to your Netway account.

https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

curl -X PATCH https://api.basavytix.com/netway/v1/config \
  -H 'x-api-key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"slack_webhook": "https://hooks.slack.com/services/T.../B.../...."}'

aws lambda invoke \
  --function-name netway-analyzer \
  --region YOUR_REGION \
  /tmp/out.json

curl -X PATCH https://api.basavytix.com/netway/v1/config \
  -H 'x-api-key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"slack_webhook": ""}'

Uninstall

To remove Netway from your AWS account completely, delete the CloudFormation stack. This removes the Lambda, S3 buckets, VPC Flow Logs created by Netway, IAM role, Athena workgroup, and EventBridge rules.

aws cloudformation delete-stack --stack-name netway-v1 --region YOUR_REGION

aws cloudformation wait stack-delete-complete --stack-name netway-v1 --region YOUR_REGION