What is AWS Cloud WAN?
AWS Cloud WAN is a managed wide-area networking service. You use it to build a unified global network that connects resources across your cloud and on-premises environments and manage it from a central dashboard. Branch offices, data centers, and Amazon VPCs are connected across the AWS global network.
Configuration is declarative through a core network policy. You describe segments, Regions, and how attachments map to segments; AWS applies the resulting configuration.
Core Features
- Core network policy: A declarative JSON document describing segments, Regional routing, and attachment mapping; multiple policy versions can be kept, but only one is in effect
- Core network edges: For each Region defined in the policy, AWS creates a Regional connection point; all edges form a full-mesh peering with each other
- Segments: Dedicated routing domains for isolating parts of the network, comparable to globally consistent VRF tables
- Attachments: VPCs, VPNs, Transit Gateway route table attachments, and Connect attachments, mapped explicitly or via tags using attachment policies
- Peering with transit gateways: Attach existing transit gateways in the same Region for end-to-end segmentation
- Cross-account use: Share a core network via AWS Resource Access Manager with a clear split between core network owner and attachment owner
- AWS PrivateLink and IPv6: PrivateLink endpoints (currently only in us-west-2 and us-gov-west-1) and IPv6 on dual-stack endpoints
Typical Use Cases
Global corporate network: Sites, data centers, and VPCs across multiple Regions are connected through a shared policy and monitored centrally.
Network segmentation: Business units, environments, or site types get their own segments. Sharing between segments is controlled deliberately through segment actions.
Centralized security functions: Internet egress for a segment is centralized, or traffic between segments is routed through a firewall.
Migrating existing transit gateway architectures: Existing transit gateways are attached through peering so segmentation spans both worlds.
Benefits
- Central, declarative control instead of manual configuration per Region
- Built-in segmentation with globally consistent routing domains
- Use of the AWS global network with redundant connections and multiple paths
- Availability in many European Regions
- Clear separation of roles for cross-account use
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS Cloud WAN: designing the core network policy and segmentation, migrating existing transit gateway architectures, connecting data centers and sites, and building operating and monitoring concepts for the global network.
Typical Use Cases
Frequently Asked Questions
What is the difference between Cloud WAN and Transit Gateway?
Cloud WAN is designed around a core network that AWS operates across multiple Regions based on a central policy. For every Region defined in the policy, Cloud WAN creates a core network edge; all edges form a full-mesh peering with each other. According to AWS, a core network edge is also known as an AWS Transit Gateway and inherits many of the same properties. If you want a global network without a core network, AWS points to AWS Global Networks for Transit Gateways. Existing transit gateways can be attached to a Cloud WAN segment through peering and route table attachments.
How does segmentation work?
Segments are dedicated routing domains. By default, only attachments within the same segment can communicate. AWS compares a segment to a globally consistent VRF table or a Layer 3 IP VPN over MPLS. Segment actions and attachment policies define which routes are shared across segments, whether centralized internet routing is used, and whether traffic is routed through a firewall.
Which attachments does Cloud WAN support?
AWS names VPCs, VPNs, Transit Gateway route table attachments, and Connect attachments. Attachments can be mapped to a segment explicitly or assigned automatically through tags using attachment policies.
Is Cloud WAN available in European Regions?
Yes. The documentation lists Europe (Frankfurt), Ireland, London, Paris, Milan, Spain, Stockholm, and Zurich, among others. Note, however, that Cloud WAN aggregates and stores Regional usage data in the home Region and that only US West (Oregon) is currently supported as the home Region. Once established, the home Region cannot be changed.
How is a core network used across accounts?
The user who creates a core network becomes its owner and can share it with other accounts or an organization using AWS Resource Access Manager. An account the core network is shared with becomes an attachment owner and may only manage attachments and tags, not core network tasks.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.