4.1.4. Network Access Analyzer

Network Access Analyzer identifies potential network access paths to specific resources, enabling network specialists to proactively verify network segmentation and detect unintended network exposure.

Scenario: You have a critical database server in a private subnet that should only be accessible from specific application servers in another subnet. You need to verify that no unintended network access paths exist to your database from other parts of the VPC or connected networks.

For network specialists, it's crucial to verify that network configurations truly block unintended access paths and that network segmentation is working as designed. Manually analyzing complex VPC configurations can be prone to human error.

Network Access Analyzer is a feature of Amazon VPC (managed in the VPC console and the EC2 API as network-insights access scopes) that analyzes the network configuration of your VPC and connected networks (e.g., peered VPCs, Transit Gateways, VPNs) to identify potential network access paths to specified resources.

Key Features of Network Access Analyzer:

• Network Access Scopes: You describe the paths to look for in MatchPaths — sources and destinations by resource ID, resource type (e.g., AWS::EC2::InternetGateway), tag, IP range, port and protocol — and list legitimate exceptions in ExcludePaths.
• Findings: An analysis reports every potential path that matches the scope and is not excluded, with the components along it. No findings means the current configuration allows no such path — evidence for segmentation and compliance reviews.
• Configuration Analysis: It evaluates route tables, security groups, NACLs, load balancers and gateways without sending packets.
• Supported Resources: Works across VPCs, VPC peering connections, Transit Gateways, VPNs, and Direct Connect connections.
• Proactive Analysis: Can be used to verify network configurations before deployment.
• Managed Service: AWS manages the underlying analysis engine.
• How It Differs from Reachability Analyzer: Network Access Analyzer does not trace one named source–destination pair. You define a Network Access Scope describing access that should not exist (e.g., any path from an internet gateway to resources tagged production), and it reports every matching path as a finding. Use it to prove segmentation across an environment; use Reachability Analyzer (4.2.5) to diagnose why one specific path does or does not work. Its CLI calls are create-network-insights-access-scope and start-network-insights-access-scope-analysis; the create-network-insights-path example below is the Reachability Analyzer call.

Practical Implementation: Using Network Access Analyzer (Conceptual)

# 1. Create a path analysis
aws ec2 create-network-insights-path \
#   --source-ip 10.0.1.10 \
#   --destination-ip 10.0.2.20 \
#   --protocol tcp \
#   --destination-port 5432 \
#   --tag-specifications 'ResourceType=network-insights-path,Tags=[{Key=Name,Value=AppToDBPath}]'

# 2. Start the analysis
aws ec2 start-network-insights-analysis \
#   --network-insights-path-id network-insights-path-0abcdef1234567890 \
#   --tag-specifications 'ResourceType=network-insights-analysis,Tags=[{Key=Name,Value=AppToDBAnalysis}]'

⚠️ Common Pitfall: Relying solely on manual review of complex network configurations. Human error is inevitable, and Network Access Analyzer can catch subtle misconfigurations that lead to unintended access.

Key Trade-Offs:

• Automated Analysis vs. Manual Effort: Network Access Analyzer automates complex path analysis, saving significant manual effort but requiring understanding of its output.

Reflection Question: How does Network Access Analyzer, by analyzing network configurations and identifying all potential access paths to specific resources, fundamentally enable you as a Network Specialist to proactively verify network segmentation and detect unintended network exposure in your AWS environment?