Using Tiros to automatically verify network segmentation configurations on AWS
Understand this story
AWS uses its automated reasoning tool Tiros to perform static verification of Cloud WAN network segmentation: it converts route tables, attachments, and policy documents into logical propositions, and checks whether reachable paths truly do not exist between network segments that the policy declares to be isolated. AWS says this is an alternative to dynamic sampling, aimed at verifying segmentation across all modeled paths. The tool can analyze the topology of a deployed network once per hour.
AI overview based on source reports · Updated 3 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Amazon ScienceUsing mathematics to validate network configurations
AWS describes using its automated-reasoning tool Tiros to statically validate network segmentation in Cloud WAN by converting configurations from route tables, attachments, and policy documents into logical propositions and querying which attachments can reach which with which destination IPs. The system checks that no path exists between segments the policy declares off limits, succeeding if actual reachability matches expected segmentation and alerting an operator if they differ, with analyses possible as often as hourly. The post illustrates this with a production/development segmentation example across us-east-1 and us-west-2 and notes the approach extends to tools like IAM Access Analyzer and VPC Reachability Analyzer.
Activity for this story
- Current comparable activity
- 3
- Peak comparable activity
- 10Nov 12 02:00
- Change in the past 24 hours
- -50%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.