AWS Network Health Score Calculator

score = 40% × resilience + 25% × quota headroom + 35% × security, where each subscore is out of 100. Each subscore is built from the design decisions AWS resiliency and security guidance calls out: zone coverage and per-zone NAT for resilience, distance from the 60-rule and 50-route quotas for headroom, and broad ingress, endpoint coverage and flow logs for security. Weighting resilience highest reflects that a zonal single point of failure fails harder than a tight quota, and the biggest-gap output points at whichever subscore is dragging the total down.

A single number makes network posture comparable across accounts and reviewable over time, which is what turns architecture review findings into a tracked metric rather than a document.

This calculator takes 8 inputs: Availability Zones with subnets, A NAT Gateway in every zone, Redundant edge connectivity, VPC Flow Logs enabled everywhere, Highest security group rule quota used, Highest route table quota used, Rules open to the whole internet, Share of AWS API traffic via VPC endpoints. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

No. The weights are a practical heuristic built from AWS Well-Architected reliability and security guidance, not an AWS product. Use it to compare accounts consistently and to find the weakest area, then verify specifics against Trusted Advisor, Security Hub and your own quota dashboards.

Because quotas fail at the worst moment. A route table at 96% of its 50-route limit works perfectly until a migration adds three prefixes, and the increase request can take days — headroom is what turns a hard stop into a planned change.