Lecture 52: Walkthrough: VPC Network Access Analyzer
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：12:48
- 来源：Udemy Lecture 41577750
- Slide 数量：12
- 画面切换：00:20、02:26、03:16、03:53、05:11、06:24、08:11、08:25、09:26、10:20、11:26
扫描说明
逐条检查了 Udemy 页面中的 254 条 Transcript cue，并对全长 12:48 的视频画面进行扫描。根据理论 Slide、实验拓扑和每次 Network Access Analyzer 分析目标的变化，共划分出 12 个独立小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Network Access Analyzer 导论
时间范围：00:00–00:20
总结 / Summary
中文
网络访问分析器（Network Access Analyzer）用于从安全策略和合规角度发现 AWS 网络中不应存在的可达路径，而不是针对单一连接解释为什么不可达。
English
Network Access Analyzer discovers reachable paths that should not exist under an organization's security and compliance policy, rather than diagnosing why one specific connection is unreachable.
Transcript
00:00 Hi.
00:00 So as discussed in the previous lecture,
00:03 now let's look at the network access analyzer.
00:05 Now this works similar to the reachability analyzer,
00:08 but just that the purpose is different.
00:11 Now, we are saying that we
00:13 want to analyze if there are any non
00:16 compliant paths exist in our network configuration.
2. Network Access Analyzer 的范围与用例
时间范围：00:20–02:26
总结 / Summary
中文
用户先用网络访问范围（Network Access Scope）描述不希望出现的连接，服务再把满足条件的实际路径列为发现项（findings）。典型用例包括隔离开发与生产网络、禁止数据库的互联网入站或出站访问、确保流量经过指定防火墙或 NAT 网关（NAT Gateway），以及只允许特定 CIDR、端口或 AWS 资源访问。
English
Users define unwanted connectivity in a Network Access Scope, and the service reports actual matching paths as findings. Typical use cases include isolating development and production networks, preventing internet ingress or egress for databases, requiring traffic to traverse a designated firewall or NAT Gateway, and allowing access only from specific CIDRs, ports, or AWS resources.
Transcript
00:20 So what's the purpose of VPC network access analyzer?
00:24 So it identifies unintended network access to the
00:27 AWS resources.
00:28 Now, this is the other way around in the sense that you have to define that
00:33 this is the connectivity that you don't want
00:35 and then you specify as a network scope and then
00:39 the network access analyzer will figure out whether
00:42 that kind of connectivity is there in your deployment
00:46 and it will flag it as findings and we will see a short demo of that.
00:51 So you can use it to say isolate network segments.
00:54 For example, there is a development VPC and the production VPC
00:58 and you want to make sure that there is no connectivity between these two VPCs.
01:02 Now you can go as granular as Subnet
01:04 level or the ENI level or EC2 instances level.
01:09 All that is possible when you configure the network scope.
01:12 Another use case is to see if there is
01:15 no internet inbound or outbound connectivity for your resources.
01:19 For example, if there are database instances,
01:22 then they should not be reachable from the internet
01:25 and the other way around.
01:26 So that can also be analyzed using the network access analyzer
01:31 further, you can also look at the trusted network paths.
01:34 That means when the traffic goes from the source to the destination,
01:38 you want to make sure that it crosses through a particular device, for example,
01:43 through the NAT gateways or through a particular Firewall.
01:46 Now, this can also be verified using network access analyzer.
01:51 And finally,
01:52 you can have the trusted network access in the sense that you can mention that the
01:56 traffic can only come from a particular IP
01:59 address range or a particular port or particular
02:03 AWS resource.
02:05 Now, in order to do this, you have to define the network scope
02:08 and then verify that whether it meets your compliance requirement or not.
02:13 I know that just from the slides,
02:15 it doesn't really tell you what exactly it does and how it does.
02:19 So better, let's look at the example and see that in action.
02:22 So let's try to analyze one of the use case.
3. 实验场景：验证 Dev 与 Prod VPC 隔离
时间范围：02:26–03:16
总结 / Summary
中文
实验准备两个完全隔离的 VPC：VPC-A 代表开发环境（development），VPC-B 代表生产环境（production）。先创建要求两者不可通信的访问范围并验证无发现项，再建立 VPC 对等连接（VPC Peering）和路由，使该策略被违反并观察发现项。
English
The lab uses two initially isolated VPCs: VPC-A represents development and VPC-B production. It first creates a scope requiring no connectivity and verifies that there are no findings, then establishes VPC Peering and routes to violate the policy and expose findings.
Transcript
02:26 So for example, we have two VPCs and VPC-A is kind of development VPC and VPC-B
02:31 is production VPC
02:33 and we don't want to have any network connectivity between them.
02:37 So to begin with, we will have these two VPCs isolated
02:41 and then we'll create the network access
02:43 analyzer scope which says that these two VPCs
02:47 should be isolated
02:48 and then we'll see what the result comes out to be.
02:51 And later,
02:52 we will set up a VPC
02:54 peering connection
02:55 so that we violate that rule.
02:57 And then we will again analyze this network scope and see the findings.
03:01 So that's the purpose.
03:03 And now to save the time,
03:04 what I have done is I have already
03:06 created these two VPCs which are completely isolated.
03:09 And currently there is no VPC peering between them. So let me take you to the
03:13 AWS console and show you that
4. 确认隔离拓扑并打开 Network Manager
时间范围：03:16–03:53
总结 / Summary
中文
两个 VPC 各有一个公有子网和一台 EC2，但没有 VPC 对等连接（VPC Peering），因此实例私有 IP 之间不能通信。讲师随后从 AWS Network Manager 进入 Network Access Analyzer，并确认分析区域（Region）为 Mumbai。
English
Each VPC contains a public subnet and an EC2 instance, but no VPC Peering connection exists, so the instances cannot communicate through private IP addresses. The instructor then opens Network Access Analyzer from AWS Network Manager and confirms the Mumbai Region.
Transcript
03:16 okay. You can see my
03:18 AWS VPC console. I'm in Mumbai Region and
03:21 I have two VPCs
03:23 and then I have one public Subnet
03:24 in each VPC. And further I have launched EC2 instances in both the VPCs.
03:31 Now these are isolated VPCs. That means
03:33 this
03:34 two machine cannot reach to each other over the private IP address, right?
03:39 And now in order to go to the network access analyzer,
03:42 you have to go to the network manager
03:44 console which is here.
03:46 And if you go on the left side, you will see this option here.
03:51 Now make sure that you are in the Mumbai Region.
5. 理解并运行 AWS 默认访问范围
时间范围：03:53–05:11
总结 / Summary
中文
AWS 账户预置了多个默认访问范围（default access scopes），用于寻找进入 VPC 的互联网网关、对等连接、VPC 端点、VPN 或中转网关路径，以及从资源到互联网的出口路径。实验选择默认的 VPC ingress 范围运行分析。
English
AWS accounts include default access scopes that look for ingress into VPCs through Internet Gateways, peering connections, VPC Endpoints, VPNs, or Transit Gateways, as well as egress paths from resources to the internet. The lab runs the default VPC ingress scope.
Transcript
03:53 Okay. So before we create our own network access scope,
03:57 let's talk about these default scopes which comes along with your
04:01 AWS account.
04:02 And
04:03 AWS has
04:04 provided these scopes for us for easy troubleshooting
04:08 So if you just read the purpose of this scope, if you just talk about this one, right?
04:13 AWS VPC
04:14 Ingress.
04:15 So what it does is it identifies the
04:17 Ingress paths into your VPC from internet Gateway or peering connection
04:22 or VPC endpoints or VPN or Transit Gateway.
04:26 That means any VPC resources which can be reached out from any of these components,
04:32 then it will flag it as finding.
04:35 Similarly, there is this egress
04:37 IGW
04:37 path which is any resource in your VPC.
04:40 If it can reach to the internet as an outbound traffic,
04:44 then it will flag those network interfaces.
04:47 Similarly, there is VPC egress
04:49 which is corresponding to the first scope,
04:52 which is, if your VPC resource can go out to the
04:56 internet or the peering connection or to the VPC endpoints.
04:59 Likewise, then it will flag those resources. And similarly the fourth one.
05:04 So to start with, let's look at the first one.
05:07 So let's select this one and analyze this.
6. 查看默认 VPC Ingress 的发现项
时间范围：05:11–06:24
总结 / Summary
中文
默认范围分析得到两个发现项，分别对应两个可从互联网网关（Internet Gateway）到达的 EC2 网络接口（ENI）。发现详情展示路径和可访问端口；当前安全组只允许 SSH，因此端口 22 出现在结果中，若再开放端口 80，分析也会反映相应端口。
English
The default scope produces two findings, one for each EC2 ENI reachable from an Internet Gateway. Finding details show the path and reachable ports; because the Security Group currently permits only SSH, port 22 appears, and opening port 80 would cause that port to appear as well.
Transcript
05:11 Now it will take maybe a couple of minutes for this analysis.
05:15 So I'm just pausing this video here.
05:18 Okay. So it took around one minute for this analysis to finish.
05:22 And if you read this, it has detected 2 findings, right?
05:26 So if you go down, you will see this 2 violations for this rule.
05:31 So first one is this
05:33 which says
05:34 sorry, it directly opens the network interface.
05:37 But if you just go down here, it will say that from the internet Gateway
05:42 you can reach out to this ENI which is attached to this particular
05:45 EC2 instance,
05:47 which we don't want because network scope is all about what you don't want, right?
05:52 So it has flagged it as your violation
05:55 and it also checks about the destination ports.
05:57 As of now, you can reach to only port 22.
06:01 But if you open the security group and allow port
06:04 80 then it will also talk about that port,
06:07 right?
06:08 And similarly, this is for another
06:10 instance in VPC-B
06:12 right? So it has flagged both these as non-compliant rules.
06:17 And now similarly, you can also run the analysis for rest of the scopes.
06:22 Okay. So I hope that is clear.
7. 创建自定义“Dev 与 Prod 不可通信”范围
时间范围：06:24–08:11
总结 / Summary
中文
讲师从空模板创建自定义访问范围，源匹配 VPC-A、目的地匹配 VPC-B，不限制 TCP/UDP 或端口，从而表达两者之间不应存在任何通用连接。控制台会把匹配条件生成 JSON 定义，创建后立即运行分析。
English
Starting from an empty template, the instructor creates a custom scope whose source matches VPC-A and destination matches VPC-B, without restricting protocol or port, expressing that no generic connectivity should exist between them. The console generates a JSON definition from the match conditions and runs the analysis.
Transcript
06:24 Now let's do our bit. That means we want to create our own scope
06:29 and then
06:30 AWS provides some templates to get started with.
06:33 For example, if you want to locate databases which are accessible from the internet
06:38 or non HTTPS access to the web server, all these are, you know,
06:41 violation to our security policies.
06:44 So you can get started with any of these templates.
06:47 But here let's start with our own empty template
06:50 and let's call it say
06:53 no connectivity
06:57 between
06:59 Dave and PROD VPC,
07:01 right?
07:02 And
07:03 we have to then define the match conditions
07:06 as in what is the source VPC
07:08 and what's the destination VPC.
07:10 So let's add a match condition and our source is VPC.
07:15 So let's say resource id and the type is VPC
07:19 and then
07:21 resource id is VPC-A.
07:25 And now you can also optionally define the traffic type,
07:29 whether it's a TCP or a UDP or what's the port, which allows this communication.
07:35 But here we are just talking about generic connectivity between the two VPCs.
07:40 So we won't add anything here.
07:42 And now you have to define the destination.
07:44 So again, the destination is the resource id of the type VPC.
07:49 And here the destination is VPC
07:51 B,
07:52 right?
07:53 That's it and say next.
07:55 So it will give you the Jason
07:58 and
07:59 create this scope.
08:01 Now, once you create the scope, you just say analyze
08:06 and again, it will take maybe a minute or so. So I'm just pausing this video again.
8. 初始结果：无 Findings，隔离符合策略
时间范围：08:11–08:25
总结 / Summary
中文
初次分析返回无发现项（no findings），证明当前没有从 VPC-A 到 VPC-B 的可行路径，网络隔离状态符合自定义策略。
English
The first analysis returns no findings, confirming that no viable path exists from VPC-A to VPC-B and that the current isolation complies with the custom policy.
Transcript
08:11 Okay.
08:12 So analysis has finished and you see there are no findings,
08:15 that means both these VPCs cannot communicate with each other.
08:19 And this is what we wanted basically.
08:21 So everything is fine
08:23 and this is what we had expected.
9. 仅创建 VPC Peering 仍无 Findings
时间范围：08:25–09:26
总结 / Summary
中文
创建并接受 VPC 对等连接（VPC Peering）后再次分析，结果仍无发现项。对等连接本身只建立连接关系；如果两侧路由表（Route Table）没有指向对端 CIDR 的路由，实际流量路径仍不存在。
English
After a VPC Peering connection is created and accepted, the analysis still reports no findings. Peering alone establishes the relationship; without routes to the peer CIDR in both route tables, no usable traffic path exists.
Transcript
08:25 Now, let's do one thing. Let's go here and let's create a VPC
08:29 peering connection between these two VPCs
08:32 which is here.
08:34 And let's create a peering connection
08:37 which is between VPC A and
08:40 VPC B,
08:47 right? And then let's create the peering connection.
08:53 So as you know, the peering has to be accepted, so let's accept the peering
08:58 and that's it.
09:00 Now we just have a peering connection,
09:02 but we haven't added anything in our route table.
09:06 So at this point, let's go here and analyze this again.
09:10 So again, let me pause this video for a minute.
09:13 Okay. So you see that still there are no findings even though there is a VPC
09:17 peering connection,
09:18 but traffic cannot flow because there are
09:21 no route tables which takes the traffic from
09:24 VPC A to VPC
09:25 B.
10. 在双方路由表加入 Peering 路由
时间范围：09:26–10:20
总结 / Summary
中文
VPC-A 路由表增加通往 VPC-B CIDR 的对等连接目标，VPC-B 路由表也增加返回 VPC-A CIDR 的路由。双向路由完成后，两个实例间具备完整的私有网络路径。
English
The VPC-A route table receives a route to the VPC-B CIDR through the peering connection, and VPC-B receives a return route to the VPC-A CIDR. With both directions configured, a complete private path now exists between the instances.
Transcript
09:26 So now let's finally go to our route table
09:29 and
09:31 let's go to the VPC A route table
09:34 and say
09:35 if the traffic is going to VPC
09:39 B which is 172.16
09:42 0.00
09:43 16,
09:45 then it has to go through the VPC
09:47 peering connection
09:50 and save it.
09:52 And similarly, let's also go to the VPC B root table
09:59 and
10:00 let's edit this route and say if the traffic is going to VPCA,
10:06 then it has to also go through the peering connection.
10:11 Okay. That's it. And now let's come back here and analyze this again.
10:17 So pause this video.
10:20 Okay.
11. 发现违规路径并查看逐跳组件
时间范围：10:20–11:26
总结 / Summary
中文
重新分析后出现两个违规 ENI 发现项。路径详情从 VPC-A 实例 ENI 出发，依次经过安全组出站规则、子网 NACL、路由表、VPC 对等连接、VPC-B 子网 NACL、安全组入站规则，最终到达 VPC-B 实例；这条完整路径违反了“Dev 与 Prod 不可通信”的策略。
English
Rerunning the analysis produces findings for two violating ENIs. The detailed path travels from the VPC-A instance ENI through its outbound Security Group rule, subnet NACL, route table, VPC Peering connection, VPC-B subnet NACL, and inbound Security Group rule to the VPC-B instance, violating the no-connectivity policy.
Transcript
10:20 So now if you see there are findings detected and
10:23 there are two network interfaces which are in violation.
10:27 So start is VPC and A and
10:29 VPC B
10:31 and the traffic can flow from VPC
10:34 A to VPC
10:35 B.
10:36 And if you see this is a VPC
10:38 peering which is allowing this traffic,
10:40 so traffic can go right from VPCA instance
10:44 ENI
10:44 to the security group, outbound rule
10:47 to the
10:48 Network-ACL of the VPCA Subnet
10:52 to the route table
10:53 to the VPC peering connection
10:55 to the Network-Access-Control-List inbound rule of VPC B Subnet,
11:01 then the EC2 instance B security group to the EC2 instance B
11:07 so end to end traffic is now
11:09 allowed which we did not want.
11:13 And that's where it has been flagged off.
11:15 So this is how you define the scope and then you run
11:17 this analysis to find out if there are any findings detected,
11:23 right?
11:24 So I hope that is clear.
12. 资源清理、分析费用与两项服务对比
时间范围：11:26–12:48
总结 / Summary
中文
实验后应终止两台 EC2、删除 VPC Peering 和 VPC，避免资源费用。教程说明 Network Access Analyzer 按每次分析涉及的 ENI 计费（视频示例为每 ENI 0.002 美元，实际应以当前 AWS 定价为准）。最后重申：VPC 可达性分析器（VPC Reachability Analyzer）诊断指定路径能否连通及阻断点，Network Access Analyzer 则发现违反策略的意外路径。
English
After the lab, the two EC2 instances, VPC Peering connection, and VPCs should be removed to avoid charges. The tutorial notes per-ENI analysis pricing for Network Access Analyzer (USD 0.002 per ENI in the video; current AWS pricing should be checked). VPC Reachability Analyzer diagnoses whether a specified path works and where it is blocked, whereas Network Access Analyzer discovers unintended paths that violate policy.
Transcript
11:26 OK, just word of caution, if you have also implemented this,
11:29 just go and terminate everything that
11:31 you created specifically these two instances
11:35 because you might not be in the free tier quota.
11:38 And once you do that also tear down your VPC
11:41 peering connection and also delete your VPCs.
11:45 And just one more thing which I should have probably stated earlier,
11:49 there is also some small charge for this excess analyzer
11:53 that is $0.002 per
11:57 ENI that is being analyzed. Now, in our case, there were two
12:00 ENIs
12:01 and hence you multiply that by this number for every analysis,
12:05 which is not a very huge price, but still there is some charge.
12:09 So just bear that in mind.
12:12 Okay. So with that, we will stop here.
12:14 So just to recap in the last couple of lectures,
12:17 we saw two ways to analyze the network traffic.
12:21 One is through the VPC reachability analyzer
12:25 where
12:26 it tells you that whether from the source you can reach to the destination
12:31 and if not, then what is blocking that traffic.
12:34 And the second is network access analyzer
12:37 which can flag the unintended network path between the source and the destination.
12:43 So that will stop here and we'll move to the next lecture. Thank you.
整讲总结 / Overall Summary
中文
本讲演示了网络访问分析器（Network Access Analyzer）的策略驱动工作流：定义不允许的连接范围，运行分析并审查发现项（findings）。仅建立 VPC Peering 不会形成违规路径；必须同时具备双方路由、安全组和 NACL 许可后，分析器才会列出完整逐跳路径。它适合持续验证网络分段、互联网暴露和强制经过安全设备等合规要求。
English
This walkthrough demonstrates the policy-driven Network Access Analyzer workflow: define unwanted connectivity, run an analysis, and inspect findings. A VPC Peering connection alone does not create a violating path; routes on both sides plus permissive Security Groups and NACLs are required before the analyzer can enumerate the complete path. The service is well suited to continuously validating segmentation, internet exposure, and mandatory traversal of security appliances.
返回顶部 ↑