Netway - AWS Network Topology, Compliance & Cost Intelligence

Netway gives engineering and compliance teams continuous visibility into their AWS network - automatically mapping how VPCs, Transit Gateways, and peering connections are actually wired together, verifying that environment boundaries are enforced, and identifying where routing misconfigurations are driving up data transfer costs.

Raw flow log records, IP addresses, and packet data never leave your AWS account. Only aggregated findings and network topology structure are transmitted to Netway.

Network Topology Intelligence

• Automatically discovers VPCs, subnets, Transit Gateways, VPC peering connections, route tables, VPC endpoints, Internet Gateways, and NAT Gateways across all monitored accounts and regions.
• Builds an interactive topology graph showing how your network is actually connected - not how it was designed to be.
• Detects topology misconfigurations: CIDR conflicts between VPCs, asymmetric routing, missing Transit Gateway propagations, orphaned VPCs, and pending peering connections.
• Tracks topology changes between scans - surfaces new connections, removed edges, and structural drift over time.

Compliance Evidence for PCI-DSS and SOC 2

• Define isolation rules between environment groups - Production, Staging, CDE, Dev, or any custom environment group. Every scan evaluates each rule by traversing the live routing graph and records a pass or fail result with a timestamp.
• Detects critical violations instantly: environment isolation breaches, CDE internet exposure via Internet Gateway or NAT, and structural topology changes that affect isolation boundaries.
• Produces auto-generated network diagrams and downloadable compliance reports in HTML and PDF format, HMAC-signed for tamper-evident audit delivery.
• Maps findings to PCI-DSS v4.0 controls (1.2.2, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.4.4, 6.3.3) and SOC 2 TSC criteria (CC6.6, CC6.7, CC6.8, CC7.1, CC7.2, CC8.1).

Data Transfer Cost Waste Detection

• Analyzes VPC Flow Logs via Athena to identify traffic patterns generating avoidable data transfer costs - S3 traffic routed through NAT Gateways, cross-AZ database traffic, NAT Gateways serving instances in the wrong Availability Zone, and more.
• Quantifies each finding in estimated monthly cost so engineering and FinOps teams can prioritize remediations by dollar impact.
• Correlates routing-plane topology with actual traffic data - confirming whether a misconfiguration is actively driving cost, not just theoretically possible.

Alerts and Integrations

• Slack: cost finding digests and immediate compliance violation alerts with full routing path detail.

How It Works

A single CloudFormation stack deploys a Lambda function into your AWS account. An EventBridge scheduled rule triggers the Lambda on your chosen interval. The Lambda collects topology data via read-only EC2 Describe APIs and analyzes VPC Flow Logs via Athena, then ships aggregated results to the Netway API over HTTPS with HMAC-SHA256 payload signing. No agents. No infrastructure changes. No write permissions requested.

What Netway Does Not Do

• Does not modify your infrastructure - all IAM permissions are read-only.
• Does not collect raw flow log records, individual IP addresses, or packet contents.
• Does not require VPC peering or private connectivity to the Netway service.