AWS Network Health Score Calculator
Score an AWS network design out of 100 on resilience, quota headroom and security, and see which area is the weakest.
About AWS Network Health Score Calculator
Each subscore is built from the design decisions AWS resiliency and security guidance calls out: zone coverage and per-zone NAT for resilience, distance from the 60-rule and 50-route quotas for headroom, and broad ingress, endpoint coverage and flow logs for security. Weighting resilience highest reflects that a zonal single point of failure fails harder than a tight quota, and the biggest-gap output points at whichever subscore is dragging the total down. A single number makes network posture comparable across accounts and reviewable over time, which is what turns architecture review findings into a tracked metric rather than a document.
Formula
AWS Network Health Score
score = 40% × resilience + 25% × quota headroom + 35% × security, where each subscore is out of 100.
- resilience
- Zone coverage, per-zone NAT Gateways and redundant edge links
- quota headroom
- How close security group and route table usage sits to its quota
- security
- Broad ingress rules, VPC endpoint coverage and flow logging
Worked example
With the default values below, AWS Network Health Score Calculator returns Network Health Score of 87. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Availability Zones with subnetsaccepts 1–6 zones
- 3 zones
- A NAT Gateway in every zone
- Yes
- Redundant edge connectivity
- Yes
- VPC Flow Logs enabled everywhere
- Yes
- Highest security group rule quota usedaccepts 0–200 %
- 65 %
- Highest route table quota usedaccepts 0–200 %
- 48 %
- Rules open to the whole internetaccepts 0–200 rules
- 4 rules
- Share of AWS API traffic via VPC endpointsaccepts 0–100 %
- 60 %
Results
- Network Health Score
- 87 out of 100
- Rating
- B — Good
- Resilience Subscore
- 100
- Quota Headroom Subscore
- 93
- Security Subscore
- 68
- Biggest Gap
- Security — close broad ingress rules and add VPC endpoints
Step by step
- 1Values used
- 2AWS Network Health Score
- 3Network Health Score= 87 out of 100
- 4Rating= B — Good
- 5Resilience Subscore= 100
- 6Quota Headroom Subscore= 93
- 7Security Subscore= 68
- 8Biggest Gap= Security — close broad ingress rules and add VPC endpoints
Assumptions and limits
- The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is AWS Network Health Score calculated?
score = 40% × resilience + 25% × quota headroom + 35% × security, where each subscore is out of 100. Each subscore is built from the design decisions AWS resiliency and security guidance calls out: zone coverage and per-zone NAT for resilience, distance from the 60-rule and 50-route quotas for headroom, and broad ingress, endpoint coverage and flow logs for security. Weighting resilience highest reflects that a zonal single point of failure fails harder than a tight quota, and the biggest-gap output points at whichever subscore is dragging the total down.
Why does AWS Network Health Score matter?
A single number makes network posture comparable across accounts and reviewable over time, which is what turns architecture review findings into a tracked metric rather than a document.
What values do I need to enter?
This calculator takes 8 inputs: Availability Zones with subnets, A NAT Gateway in every zone, Redundant edge connectivity, VPC Flow Logs enabled everywhere, Highest security group rule quota used, Highest route table quota used, Rules open to the whole internet, Share of AWS API traffic via VPC endpoints. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is this an official AWS score?
No. The weights are a practical heuristic built from AWS Well-Architected reliability and security guidance, not an AWS product. Use it to compare accounts consistently and to find the weakest area, then verify specifics against Trusted Advisor, Security Hub and your own quota dashboards.
Why does quota usage matter for health?
Because quotas fail at the worst moment. A route table at 96% of its 50-route limit works perfectly until a migration adds three prefixes, and the increase request can take days — headroom is what turns a hard stop into a planned change.