Topology
Topology tree and map
Shows the relationships among global network resources as a tree and a topology graph. Site locations appear on a map powered by Amazon Location Service.
AWS Network Manager · Global network operations console
See networks spread across Regions and accounts on a single screen
AWS Network Manager brings transit gateways across multiple Regions, Cloud WAN core networks, and on-premises sites together into one global network. Topology, events, route analysis, and AWS backbone latency are all available in one place.
topology tree · home us-west-2MONITORING
- Global networkglobal-network-0f3acontainer
- TGW Seoulap-northeast-2registered
- VPNcgw ↔ device dc-rtr-01up
- TGW Tokyoap-northeast-1registered
- Core networkCloud WANpolicy v7
- Site Pangyo DCdevice · link ISP-Aon-prem
Transit gateways in two Regions, a Cloud WAN core network, and an on-premises site all sit under one global network.
us-west-2
Home Region that collects topology and event data
No extra charge
Global network management for Transit Gateway
10
Delegated administrator accounts you can register in Organizations
p50 · 5 min
Statistic and aggregation period of Infrastructure Performance CloudWatch metrics
Why Network Manager
The bigger the network, the harder it is to answer "what state is it in right now?"
With a transit gateway in every Region, VPCs attached from every account, and data centers and branches coming in over VPN and Direct Connect, status checks get scattered across per-Region consoles. Network Manager registers these resources in one global network so you can view them on the same screen and in the same event stream.
See
Topology in one place
Draws registered transit gateways and their attachments, VPNs, Connect peers, and on-premises sites as a topology tree and a map. No need to hop between Regions and accounts.
Know
Changes delivered as events
Receive topology changes, route changes, and tunnel and BGP status changes as EventBridge events. Plug notifications and automated responses into your existing event pipeline.
Verify
Check routes and latency
Follow routes through Transit Gateway route tables with Route Analyzer, and check AWS network latency between Regions and AZs with Infrastructure Performance.
Global network objects
The building blocks of a global network
A global network is the top-level container for your network objects. On the AWS side, you populate it by registering transit gateways or creating a Cloud WAN core network; on the on-premises side, you model sites, devices, and links.
Global networkcontainerThe top-level object that represents a single private network. It can hold both transit gateways and a Cloud WAN core network.
Transit Gateway registrationAWSRegister transit gateways from multiple Regions and accounts. Topology and events are collected from the moment of registration.
Core networkAWSA global core network built with Cloud WAN. Policies, segments, and attachments are managed in the same console.
Siteon-premA physical location such as a branch, office, store, campus, or data center. Enter an address or coordinates to show it on the map.
Deviceon-premA physical or virtual appliance at a site, including routers, firewalls, SD-WAN appliances, and virtual appliances in other clouds.
Linkon-premA single internet connection at a site. Records the provider, link type, and bandwidth.
Connectionon-premA connection between two devices, either between on-premises devices or between an on-premises device and a virtual appliance in a VPC.
AssociationmappingAssociates a Site-to-Site VPN customer gateway or a Transit Gateway Connect peer with a device (and optionally a link), tying AWS resources to on-premises objects.
The multiple names can be confusing. The console is called Network Manager; the documentation calls the part where you register transit gateways AWS Global Networks for Transit Gateways, and the part where you build a core network AWS Cloud WAN. Both run on the same global network.
Features
Key features
Dashboard
Transit Gateway network dashboard
Aggregates CloudWatch metrics such as traffic and packet drops for registered transit gateways and attachments, along with VPN status, per global network.
Events
EventBridge events
Sends Topology Change, Routing Update, and Status Update events from the aws.networkmanager source. With Cloud WAN, segment and policy events are delivered too.
Route Analyzer
Route analysis
Enter source and destination Transit Gateway attachments and IPs to analyze the path through the route tables. It can include the return path and traversal of middleboxes in a VPC.
Performance
Infrastructure Performance
Shows AWS network latency between Regions, between AZs, and within an AZ, in near real time and for historical periods. You can subscribe to it as CloudWatch metrics.
Multi-account
Organizations integration
With trusted access enabled and a delegated administrator account registered, you can register and monitor transit gateways from other member accounts in a single global network.
Ops questions
Which feature answers which operational question
Network Manager is not in the data path. It is a monitoring layer that collects and displays the configuration and state of your existing transit gateways and Cloud WAN. The feature you use and the scope it covers depend on the question.
| Operational question | Feature | Scope | Limits · complements |
|---|---|---|---|
| What is connected to what, and where? | Topology tree · topology graph · map | Registered transit gateways, attachments, VPNs, Connect peers, sites · devices · links | On-premises objects appear on the map only after you register them. |
| What just changed? | Events (EventBridge) | Attachment creation and deletion, route additions and removals, VPN tunnel and BGP status changes | Changes made before registration are not recorded. Delivery is best effort. |
| Is there a route from A to B? | Route Analyzer | Transit Gateway route tables (IPv4 · IPv6), return path | Does not look at VPC route tables, security groups, or network ACLs. Complement with Reachability Analyzer and VPC Flow Logs. |
| Is the AWS network slow? | Infrastructure Performance | AWS backbone latency between Regions, between AZs, and within an AZ (p50) | Excludes paths through VPC resources such as transit gateways, NAT gateways, and ELB. Does not tell you the cause of degradation. |
| How much traffic is flowing? | Dashboard · CloudWatch metrics | Bytes · packets · drops for transit gateways and attachments | For flow-level analysis, use Transit Gateway Flow Logs. |
Reference architecture
A global network spanning two Regions and on-premises
Register the Seoul and Tokyo transit gateways in a global network, and model the data center and branch office as sites. Topology and event data are collected in the home Region, us-west-2, and events flow through EventBridge to CloudWatch Logs and notifications.
On narrow screens, swipe the diagram sideways.
Getting started
Steps to set up a global network
- STEP 1
Create a global network
Create a global network in the Network Manager console. Data is collected in us-west-2.
- STEP 2
Set up multiple accounts
Enable Organizations trusted access and register a delegated administrator. The required roles are deployed with StackSets.
- STEP 3
Register transit gateways
Register transit gateways from your Regions and accounts. If you use Cloud WAN, create a core network.
- STEP 4
Model on-premises
Create sites, devices, and links, and associate customer gateways and Connect peers with devices.
- STEP 5
Wire up events and metrics
Onboard to CloudWatch Logs Insights, then set up EventBridge rules and latency subscriptions.
Pricing
Cost components
There is no additional charge for managing transit gateways as a global network. Costs come from the managed network resources and from integrated services such as CloudWatch that store events and metrics.
| Item | Billed by | Notes |
|---|---|---|
| Network Manager features | No additional charge | Includes topology, dashboards, events, Route Analyzer, and Infrastructure Performance views. |
| Transit Gateway | Attachment hours and GB of data processed | Standard Transit Gateway pricing applies whether or not it is registered. |
| Cloud WAN | Core network edge hours, attachment hours, GB of data processed | Configured in Network Manager but billed separately under Cloud WAN pricing. |
| CloudWatch | Logs ingestion and storage GB, number of metrics, number of alarms | Covers the event log group (us-west-2) and Infrastructure Performance subscription metrics. Each subscribed Region or AZ pair creates one metric. |
| EventBridge · notification targets | Usage of the services used as rule targets | Target services such as SNS, Lambda, and Step Functions are each billed at their own rates. |
| VPN · Direct Connect links | Connection hours, port hours, data transfer | Billed under Site-to-Site VPN and Direct Connect pricing. |
| AWS PrivateLink | Interface endpoint hours and GB processed | Applies only when calling the Network Manager API privately from a VPC. Currently supported only through dual-stack endpoints in us-west-2 and us-gov-west-1. |
Unit prices vary by Region and usage. Check the latest prices on the Transit Gateway pricing page and the CloudWatch pricing page.
Next step
Let's sketch your network's operations view together
Bring your operating Regions and account structure, your list of transit gateways, and your on-premises site and circuit details, and we will review the global network registration scope and event notification design together.