Network topology

The Network screen (/network) draws your cross-cloud network as a topology map — the one signature visual of the console — with everything else kept quiet around it.

What the map shows

• Segments — your VPCs and VNets, grouped by region, each with its CIDR, subnet and instance counts.
• Plumbing nodes — the full network dependency graph: internet gateways (IGW), NAT gateways (NAT), VPC endpoints (EP), route tables (RT) and transit-gateway attachments (TGW), drawn beside their VPC with a distinct badge.
• Dependency edges — how everything connects: a route table's association lines to its subnets (explicit associations, plus a *main* route table's implicit coverage of every subnet with no explicit association — those edges say "implicit (main route table)" on hover), a route table's route to a gateway/NAT/endpoint/peering target (the *routable* plumbing), and gateway/endpoint/attachment bindings to their VPC.
• Traffic edges — when traffic data exists, directional edges are weighted by volume (thicker + warmer = more bytes) so hot paths stand out from idle ones; a legend explains the scale.
• Links — peering and VPN connections between segments; live flow animation marks active links.
• Hover for details — hovering any node shows its real facts (type, native id, CIDR, AZ, a route table's route entries and its associated-subnet count incl. implicit coverage, an endpoint's service name, a gateway's state) and any traffic bytes/packets; hovering an edge shows what it carries.
• Resizable boxes — every container box (a VPC/VNet, a subnet, the unplaced tray) has a bottom-right corner grip: drag it (mouse or touch) to resize the box. The minimum is whatever is inside it — children are never clipped. Resize is a view-only adjustment: like drag positions it is not persisted, and Auto-arrange resets it.
• Status — every segment, node and link carries the shared status scale (see below).

The status scale

Status is never colour alone. It always pairs a colour with a glyph and text, so it is readable for colour-blind operators and in any theme:

Map and table parity

Every map interaction is also available as a table — segment health and inventory both have a table view — so the topology is fully usable with a keyboard and a screen reader, not only by pointing at the map.

Structural graph vs. traffic overlay

The dependency graph (VPCs, subnets, gateways, endpoints, route tables, transit-gateway attachments and how they connect) is discovered from real AWS APIs — DescribeInternetGateways, DescribeNatGateways, DescribeVpcEndpoints, DescribeRouteTables and DescribeTransitGatewayAttachments — for every connected AWS account, so you see the full plumbing *with and without* traffic. Every plumbing node is also listed in Inventory and can be imported into Terraform (a route table becomes aws_route_table, an internet gateway aws_internet_gateway, and so on).

The traffic overlay weights the edges by real byte/packet volume. It requires VPC Flow Logs to be enabled on the VPC. Cushy detects whether flow logs are configured; when they are not (or byte aggregation is not yet turned on for the connection) the map honestly shows the dependency graph without traffic and a note saying so — it never fabricates volume.

Status today

The structural dependency graph (VPCs/subnets/IGW/NAT/endpoints/route-tables/TGW attachments + their edges, incl. route-table→subnet association lines with implicit main-table coverage), resizable container boxes, the traffic overlay, per-node/per-edge hover details, pan/zoom, segments and status theming are shipped. Route-table→subnet association fidelity is AWS today; Azure/Alibaba still draw a single route-table→VNet/VPC association edge. Traffic requires VPC Flow Logs; real flow-log byte ingestion on live AWS is the next step (the data model and UI are complete). The reachability / path-analysis engine is now shipped — see Network reachability; drag-to-connect persistence remains on the roadmap — see Preview & roadmap features.