# VPC and Network Enumeration

- **URL:** https://hackindex.io/platforms/aws/enumeration/vpc/vpc-and-network-enumeration
- **Path:** AWS > Enumeration > VPC
- **Up:** [VPC](https://hackindex.io/platforms/aws/enumeration/vpc.md)
- **Published:** 2026-05-24
- **Updated:** 2026-05-24

Network topology shapes what is reachable from a compromised resource. VPC peering, transit gateways, and direct connections extend the blast radius far beyond a single VPC.

Key network components to enumerate:

- VPCs and their CIDR ranges
- Subnets with public IP auto-assign enabled
- Internet gateways and NAT gateways
- VPC peering connections, especially cross-account
- Transit gateway attachments linking multiple VPCs

## VPCs

```bash
aws ec2 describe-vpcs --profile $PROFILE --region $REGION --query 'Vpcs[*].{ID:VpcId,CIDR:CidrBlock,Default:IsDefault,Name:Tags[?Key==`Name`]|[0].Value}' --output table
```

Multiple VPCs in an account often indicate environment separation (dev/staging/prod). VPC peering between them is a lateral movement path.

## Subnets

```bash
aws ec2 describe-subnets --profile $PROFILE --region $REGION --query 'Subnets[*].{ID:SubnetId,VPC:VpcId,CIDR:CidrBlock,AZ:AvailabilityZone,Public:MapPublicIpOnLaunch}' --output table
```

`MapPublicIpOnLaunch: true` = instances launched here get public IPs automatically.

## Internet Gateways

```bash
aws ec2 describe-internet-gateways --profile $PROFILE --region $REGION --query 'InternetGateways[*].{ID:InternetGatewayId,VPC:Attachments[0].VpcId}' --output table
```

A VPC with an internet gateway attached and a route table pointing `0.0.0.0/0` to it has public internet access.

## Route Tables

```bash
aws ec2 describe-route-tables --profile $PROFILE --region $REGION --query 'RouteTables[*].{ID:RouteTableId,VPC:VpcId,Routes:Routes,Subnets:Associations[*].SubnetId}' --output json
```

Look for routes to `igw-*` (internet gateway) on `0.0.0.0/0`: those subnets have outbound internet access.

## VPC Peering Connections

Peering connections link VPCs: a compromised instance in one VPC may reach resources in the peer:

```bash
aws ec2 describe-vpc-peering-connections --profile $PROFILE --region $REGION --query 'VpcPeeringConnections[*].{ID:VpcPeeringConnectionId,Requester:RequesterVpcInfo.VpcId,Accepter:AccepterVpcInfo.VpcId,Status:Status.Code}' --output table
```

Check if cross-account peering exists: `AccepterVpcInfo.OwnerId` differs from `RequesterVpcInfo.OwnerId`.

## Transit Gateways

Transit gateways connect multiple VPCs and on-premises networks. Presence indicates a larger connected environment:

```bash
aws ec2 describe-transit-gateways --profile $PROFILE --region $REGION
aws ec2 describe-transit-gateway-attachments --profile $PROFILE --region $REGION
```

## NAT Gateways

NAT gateways give private subnets outbound internet access. Useful for understanding egress paths from internal resources:

```bash
aws ec2 describe-nat-gateways --profile $PROFILE --region $REGION --query 'NatGateways[*].{ID:NatGatewayId,VPC:VpcId,Subnet:SubnetId,State:State,PublicIP:NatGatewayAddresses[0].PublicIp}' --output table
```

## VPC Flow Logs

Check if VPC flow logs are enabled: relevant for understanding detection coverage:

```bash
aws ec2 describe-flow-logs --profile $PROFILE --region $REGION --query 'FlowLogs[*].{ID:FlowLogId,Resource:ResourceId,Status:FlowLogStatus,Destination:LogDestination}' --output table
```

`ACTIVE` flow logs mean network traffic is being logged to CloudWatch or S3. Adjust lateral movement techniques accordingly.

## Network ACLs

NACLs are stateless filters at the subnet level: stricter than security groups and harder to bypass:

```bash
aws ec2 describe-network-acls --profile $PROFILE --region $REGION --query 'NetworkAcls[*].{ID:NetworkAclId,VPC:VpcId,Default:IsDefault,Entries:Entries}' --output json
```

A default NACL allows all traffic. Custom NACLs with `DENY` rules on specific ports block traffic even if the security group allows it.