🗺️ Network Topology
An interactive map of your entire AWS network, updated on every scan.
| Feature | Description |
|---|---|
| Interactive graph | Force-directed D3.js graph. VPCs, TGWs, Internet Gateways, NAT Gateways shown as AWS icons. Click any node to inspect it. |
| Environment groups | VPCs automatically grouped by environment tag (production, staging, development, cde, dmz, or any custom name). Tag keys checked: environment, env, stage, tier, netway:env. Colour-coded rings show compliance status. |
| Reachability query | The graph shows which VPCs can reach each other. Click any VPC node to see its reachable peers highlighted. |
| Reachability matrix | Full N×N matrix of all VPC pairs. Download as CSV. |
| CIDR map | All CIDR blocks across all VPCs, with overlap detection highlighted. |
| Topology change history | Every scan diffs the current snapshot against the previous one. Changes are recorded with severity: critical (internet gateway attached to previously internal VPC), high (new peering connection, security group rule added), medium (route table change, NAT gateway added), low (tag update, description change). Searchable without pre-configuring Config rules. |
| Snapshot history | Browse past topology snapshots. Compare any two snapshots. |
| Compute instances | Click a VPC to see EC2 instances within each subnet — instance type, state, private IP. |
🛡️ Compliance & Security Posture
Daily isolation monitoring, security posture checks, 365-day audit history, and one-click compliance report.
Network Isolation
| Feature | Description |
|---|---|
| Isolation rules | Select two environment groups (e.g. production and staging) — Netway evaluates whether any network path exists between them on every scan. |
| Rule history | 365 days of pass/fail results per rule. Immutable audit log. |
| Topology detectors | CIDR conflict, orphaned VPC, CDE internet exposure, missing TGW propagation, and more. |
| Compliance report | Signed HTML or PDF evidence report. Sections covering PCI-DSS 1.2.3, 1.2.4, 1.3.x, 1.4.1, 11.4.5 and SOC2 CC6.x, CC7.2, CC8.1. |
| Network diagram | Auto-generated network diagram (PNG + SVG) using AWS Architecture Icons. Embedded in the compliance report. |
| Report signing | HMAC-SHA256 signature on every report — proves integrity and origin. |
| Environment group inference | Infers environment groups from VPC tags on every scan. Checks environment, env, stage, tier, netway:env keys. PCI/CDE tags (pci, data-classification) take priority. Unknown tag values are preserved verbatim as custom groups. Manual overrides survive re-scans. |
Security Posture
| Check | What it detects |
|---|---|
| Open security group ports | Security groups with unrestricted ingress (0.0.0.0/0 or ::/0) on sensitive ports — SSH (22), RDP (3389), database ports (5432, 3306, 1433, 27017). |
| Plaintext SSM secrets | SSM parameters whose names contain secret-like keywords (password, secret, key, token) stored as String instead of SecureString. Parameter values are never read or sent. |
| Lambda credential keys | Lambda functions with environment variable key names that look like secrets — catches plaintext API keys and tokens stored in Lambda configuration. Values are never read or sent. |
| Active default VPCs | Default VPCs that are still active. Default VPCs come with permissive settings and should be removed or unused in production accounts. |
| VPCs missing flow logs | VPCs without flow log coverage — no visibility into traffic means no audit trail and no cost analysis for that VPC. |
| Finding lifecycle | Findings resolve automatically when the underlying config is fixed. They re-appear if the issue is reintroduced. Each finding carries first_seen, last_seen, and resolved_at timestamps. |
| Posture scores | Per-scan compliance score per account. Track posture improvement over time. |
| Slack alerts | Immediate alert on new critical posture findings and isolation rule violations. |
| Requirement | Coverage |
|---|---|
| PCI-DSS 1.2.3 | Auto-generated network diagram |
| PCI-DSS 1.2.4 | Flow log traffic overlay on topology |
| PCI-DSS 1.3.1 / 1.3.2 | Routing + traffic plane isolation evidence |
| PCI-DSS 1.4.1 | CDE exposure detector |
| PCI-DSS 11.4.5 | 365-day daily scan log |
| SOC2 CC6.1 | Environment group isolation rules |
| SOC2 CC6.6 | Internet exposure detection + open security group port checks |
| SOC2 CC7.2 | Topology change history with severity classification |
| SOC2 CC8.1 | Change log in compliance report |
💰 Cost Optimisation
Detects avoidable AWS network spend from VPC flow logs.
Note: Netway detects multiple categories of avoidable network spend. Each finding includes the source resource, estimated monthly savings, and exact CLI fix command.
| Pattern | Typical Saving |
|---|---|
| S3 via NAT Gateway | $200–500/mo |
| Avoidable Internet Egress | $500–8,000/mo |
| Cross-Region S3 Access | $200–1,000/mo |
| Cross-AZ Database Traffic | $50–200/mo |
| AWS APIs via NAT | $30–150/mo |
| NAT Gateway in Wrong AZ | $20–100/mo |
| ML Checkpoint via NAT | $300–2,000/mo |
| GPU Cross-AZ Gradient Sync | $100–800/mo |
| Inference Cold Start S3 | $50–400/mo |
| + more patterns | — |
🌍 Multi-Region Deployment
Deploy and manage Netway stacks across multiple AWS regions with a single script. All regions report into one dashboard.
| Feature | Description |
|---|---|
| One-command deploy | netway-deploy.sh deploy deploys the CloudFormation stack in parallel across all specified regions. Progress is shown per region. |
| Lifecycle management | Single script for the full stack lifecycle: deploy, status, update, delete. All commands operate across all deployed regions at once. |
| Cross-region scan | netway-deploy.sh scan triggers a Lambda scan in every deployed region in parallel. Use --wait to block until all scans complete. |
| State file | Deployed regions, stack name, and VPC config saved to ~/.netway/regions — no need to re-specify on each command. |
| Auto template update | netway-deploy.sh update downloads the latest CloudFormation template from the Netway releases bucket and applies it to all regions. |
| Unified dashboard | Topology, findings, and compliance results from all regions appear in one dashboard. The topology graph labels each VPC by region. |
🏢 Multi-Account Support
Monitor VPCs across multiple AWS accounts under one Netway subscription. One API key, one dashboard, unified topology and compliance.
| Feature | Description |
|---|---|
| Account allow-list | Link additional AWS accounts from the dashboard. Only explicitly approved accounts can post findings — a stolen API key from an unknown account is rejected. |
| Same API key | Deploy the Netway Lambda into each account using the same API key. No cross-account IAM trust or management account access required. |
| Unified topology graph | VPCs from all accounts appear in one topology graph, labelled by account ID. Filter the graph by account using the account dropdown. |
| Cross-account compliance | Isolation rules and compliance reports span all linked accounts. A rule can reference environment groups from different AWS accounts. |
| Multi-account scan | netway-deploy.sh scan --profile prod-account --profile staging-account triggers scans across multiple accounts in parallel using AWS CLI profiles. |
| Per-account scan tracking | Dashboard shows each linked account's label and last scan time. Know at a glance which accounts are reporting fresh data. |
📦 Pricing
One plan. Every feature included. 14-day free trial, no credit card required.
$299
/ month
or $2,990 / year · save 2 months
✅ Unlimited VPCs, AWS accounts, and regions
✅ Scans every 6 hours
✅ Full topology graph, reachability matrix, CIDR map
✅ Compliance reports — HTML + HMAC-signed PDF
✅ 365-day audit history
✅ All cost anomaly detectors
✅ Multi-region deployment script
✅ Slack alerts and email digest
✅ 14-day free trial included
Have specific requirements? We work directly with engineering and compliance teams to fit Netway into your environment — SSO, custom integrations, private deployment, and co-develop features built for your use case.
Contact us → support@basavytix.com
14-day free trial. No refunds on completed billing periods. Annual subscribers may request a prorated refund within 30 days of renewal. Full refund policy →