AWS vpc: Add 1:1 NAT CloudWatch metrics for transit gateway attachments
Summary
Adds four new CloudWatch metrics (BytesInNAT, BytesOutNAT, PacketsInNAT, PacketsOutNAT) to the transit gateway metrics tables and explains how NAT-translated traffic is counted per attachment.
Security assessment
The change only documents new observability metrics for 1:1 NAT traffic accounting; it introduces no authentication, encryption, or access-control behavior and references no vulnerability.
Evidence
`BytesInNAT` | The number of bytes received from an attachment whose source address was translated (SNAT) by that attachment's NAT rules. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html). **Statistics** : The only meaningful statistic is `Sum`.
Diff
diff --git a/vpc/latest/tgw/transit-gateway-cloudwatch-metrics.md b/vpc/latest/tgw/transit-gateway-cloudwatch-metrics.md index 2749dac..7211891 100644 --- a//vpc/latest/tgw/transit-gateway-cloudwatch-metrics.md +++ b//vpc/latest/tgw/transit-gateway-cloudwatch-metrics.md @@ -44,0 +45,4 @@ Metric | Description +`BytesInNAT` | The number of bytes received from an attachment whose source address was translated (SNAT) by that attachment's NAT rules. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html). **Statistics** : The only meaningful statistic is `Sum`. +`BytesOutNAT` | The number of bytes sent to an attachment whose destination address was translated (DNAT) by that attachment's NAT rules. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html). **Statistics** : The only meaningful statistic is `Sum`. +`PacketsInNAT` | The number of packets received from an attachment whose source address was translated (SNAT) by that attachment's NAT rules. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html). **Statistics** : The only meaningful statistic is `Sum`. +`PacketsOutNAT` | The number of packets sent to an attachment whose destination address was translated (DNAT) by that attachment's NAT rules. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html). **Statistics** : The only meaningful statistic is `Sum`. @@ -66,0 +71,4 @@ Metric | Description +`BytesInNAT` | The number of bytes received from an attachment whose source address was translated (SNAT) by that attachment's NAT rules. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html). **Statistics** : The only meaningful statistic is `Sum`. +`BytesOutNAT` | The number of bytes sent to an attachment whose destination address was translated (DNAT) by that attachment's NAT rules. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html). **Statistics** : The only meaningful statistic is `Sum`. +`PacketsInNAT` | The number of packets received from an attachment whose source address was translated (SNAT) by that attachment's NAT rules. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html). **Statistics** : The only meaningful statistic is `Sum`. +`PacketsOutNAT` | The number of packets sent to an attachment whose destination address was translated (DNAT) by that attachment's NAT rules. For more information, see [1:1 NAT in AWS Transit Gateway](./tgw-nat.html). **Statistics** : The only meaningful statistic is `Sum`. @@ -71,0 +80,2 @@ Metric | Description +The `BytesInNAT`, `BytesOutNAT`, `PacketsInNAT`, and `PacketsOutNAT` metrics count the subset of traffic translated by 1:1 NAT. The existing `BytesIn`, `BytesOut`, `PacketsIn`, and `PacketsOut` metrics continue to report all traffic. Each NAT metric is counted against the attachment whose rule applied. For example, traffic from an attachment without NAT rules to the NAT address of a VPC with NAT rules appears in that VPC attachment's `PacketsOutNAT`. It doesn't appear in the source attachment's `PacketsInNAT`. When both the source and destination are translated, a packet counts in both the source attachment's `PacketsInNAT` and the destination attachment's `PacketsOutNAT`. +