AWS network-manager: Document 1:1 NAT CloudWatch metrics for Cloud WAN

Service: network-manager · 2026-10-23 · Documentation low

File: network-manager/latest/cloudwan/cloudwan-metrics.md · Type: logging

Summary

Adds a new section describing four 1:1 NAT metrics (PacketsInNAT, PacketsOutNAT, BytesInNAT, BytesOutNAT) in the AWS/Network Manager namespace, their dimensions, and which accounts they are published to.

Security assessment

The change only documents new CloudWatch monitoring metrics for NAT-translated traffic and their dimensions/account visibility. It improves observability of NAT traffic but does not describe a vulnerability, credential handling, or access control, so it is security-tangential at most.

Evidence

+### 1:1 NAT metrics

Diff

diff --git a/network-manager/latest/cloudwan/cloudwan-metrics.md b/network-manager/latest/cloudwan/cloudwan-metrics.md
index e4ea583..8b4dae0 100644
--- a//network-manager/latest/cloudwan/cloudwan-metrics.md
+++ b//network-manager/latest/cloudwan/cloudwan-metrics.md
@@ -34,0 +35,32 @@ Metric | Description
+### 1:1 NAT metrics
+
+Cloud WAN publishes four metrics in the `AWS/Network Manager` namespace for traffic translated by 1:1 network address translation (NAT). They count a subset of the traffic in the existing `PacketsIn`, `PacketsOut`, `BytesIn`, and `BytesOut` metrics, which continue to report all traffic. Metrics are published every minute in the US West (Oregon) AWS Region, like other Cloud WAN metrics.
+
+The following table describes the 1:1 NAT metrics.
+
+Metric | Description  
+---|---  
+`PacketsInNAT` |  Packets received from an attachment whose source address was translated (SNAT) by that attachment's NAT rules. **Statistics** : The only meaningful statistic is `Sum`.  
+`PacketsOutNAT` |  Packets sent to an attachment whose destination address was translated (DNAT) by that attachment's NAT rules. **Statistics** : The only meaningful statistic is `Sum`.  
+`BytesInNAT` |  Bytes received from an attachment whose source address was translated (SNAT) by that attachment's NAT rules. **Statistics** : The only meaningful statistic is `Sum`.  
+`BytesOutNAT` |  Bytes sent to an attachment whose destination address was translated (DNAT) by that attachment's NAT rules. **Statistics** : The only meaningful statistic is `Sum`.  
+  
+Cloud WAN counts each metric against the attachment whose rule applied. With double NAT, a packet counts in both the source attachment's `PacketsInNAT` and the destination attachment's `PacketsOutNAT`.
+
+**Dimensions**
+
+  * `CoreNetwork`, `EdgeLocation`
+
+  * `CoreNetwork`, `Attachment`
+
+  * `CoreNetwork`, `Attachment`, `EdgeLocation` (Direct Connect gateway attachments)
+
+  * `CoreNetwork`, `EdgeLocation`, `AvailabilityZone` (VPC attachments only)
+
+  * `CoreNetwork`, `Attachment`, `AvailabilityZone` (VPC attachments only)
+
+
+
+
+Cloud WAN publishes NAT metrics to the core network owner's account. For an attachment owned by another account, Cloud WAN also publishes them to the attachment owner's account.
+