A blank or misleading AWS network dashboard can have several causes, but AWS does not provide one service named “Network Dashboard.” The page may be an Amazon CloudWatch dashboard, the AWS Network Manager view for transit gateway networks, or the AWS Health Dashboard. Each one displays different information. Identify the page and the signal you expect before enabling more data collection.

Use the checks below to trace the issue from the dashboard back to its account, Region, resource, metric, or log source.

First identify which AWS dashboard you are using

ViewWhat it showsFirst check when it looks wrong
CloudWatch dashboardWidgets that you or AWS configure with metrics, alarms, logs, or other telemetry.Check the widget’s account, Region, time range, metric dimensions, and permissions.
AWS Network ManagerTopology, events, and monitoring for resources registered in a global network, especially transit gateways and their attachments.Confirm the transit gateway is registered in the intended global network and select it on the Monitoring tab.
AWS Health DashboardAWS-published service events and account-specific notifications.Check the account, service, Region, event filters, and time range. Health events are not workload metrics.

CloudWatch dashboards are global, but their metric widgets query data from the account and Region where each metric was published. Network Manager also needs a global network and registered transit gateways before it can show that topology. AWS Health reports AWS-published events, not workload metrics; see the AWS Health event overview or the site's AWS Health Dashboard guide.

Metrics are missing or look wrong

Start with the data source and its scope. A CloudWatch metric is identified by its namespace, metric name, and dimension combination, and metrics exist in the Region where they were published. A widget for the wrong Region, account, instance ID, or time window can show no data even when the resource is healthy. Check the service's metric documentation before assuming that a network metric is published automatically.

Also confirm that the selected statistic answers the question. For example, EC2's NetworkIn is bytes received by an instance during each period. Use Sum to inspect total bytes for that period; it is not a latency or packet-loss measurement. With basic EC2 monitoring, network metrics are normally published in five-minute periods. See AWS's EC2 metric definitions and CloudWatch metric concepts.

A chart is blank, incomplete, or does not load

Open the widget's metric details and check whether CloudWatch can return points for the same period. If the metric appears in CloudWatch but not in the dashboard, inspect the widget's region and account settings, metric dimensions, time range, and period. Cross-account widgets also depend on the monitoring account being configured to observe the source account.

If the data is present in CloudWatch but the console itself renders incorrectly, reload the page, try a private window with extensions disabled, or compare with another browser. If that isolates the issue, re-enable extensions one at a time before clearing browser data. A browser-cache problem does not explain missing metric points returned by the CloudWatch API.

Access is denied or the console will not load

First verify the account and role shown in the console. For a CloudWatch dashboard, AWS documents cloudwatch:GetDashboard and cloudwatch:ListDashboards for viewing dashboards. Graphs, alarms, and logs can require additional read permissions for their data sources; AWS lists those actions in its CloudWatch permissions reference. For Network Manager, the viewing identity needs access to the global network and the related resource data; AWS's Network Manager IAM guide describes the service permissions.

Review the exact denied action and any explicit deny from an IAM policy, permissions boundary, organization service control policy, or VPC endpoint policy. Do not add aws:SourceIp or aws:SourceVpc conditions as generic dashboard fixes: they restrict requests by network origin, and aws:SourceVpc is present only when the request uses a VPC endpoint. Check AWS's global condition key reference before changing a policy that uses them.

The view is slow or its values seem delayed

Separate console responsiveness from data publication. Check one widget over a shorter time range, then compare it with the same metric in CloudWatch Metrics or the CLI. If one graph is slow, inspect its query and time range; if all widgets are slow, check whether the console request is being denied or timing out. Changing dashboard size or waiting for off-peak hours will not repair a wrong metric or missing permission.

Metrics are not all real time. EC2 network metrics are normally published every five minutes with basic monitoring, while VPC Flow Logs aggregate and deliver records later. For supported EC2 resources, detailed monitoring changes the metric interval to one minute and has separate charges; review AWS pricing before enabling it for troubleshooting.

Troubleshoot the data path in order

1. Confirm the account, Region, metric, and dimensions

Use the same account, Region, resource, and time window shown in the dashboard. For example, list recent EC2 NetworkIn metrics in a Region:

aws cloudwatch list-metrics --namespace AWS/EC2 --metric-name NetworkIn --region eu-central-1

Then query a known instance directly. Replace the example instance ID and UTC timestamps with the resource and incident window you are investigating:

aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name NetworkIn \
  --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
  --start-time 2026-10-04T10:00:00Z \
  --end-time 2026-10-04T11:00:00Z \
  --period 300 \
  --statistics Sum \
  --region eu-central-1

If the result is empty, check that the instance ID, namespace, metric name, dimensions, Region, and time range match published data. The CLI timestamps are UTC and the end time is exclusive. CloudWatch's GetMetricStatistics reference explains the required dimensions and statistics. Metrics without new data points for two weeks might not appear in the console's metric search; they can still be queried directly if you know their dimensions.

2. Inspect the dashboard widget and time settings

Compare the widget with the metric you just queried. Confirm its namespace, metric, dimensions, account, Region, period, statistic, and dashboard-wide time range. When the dashboard uses cross-account or cross-Region metrics, confirm the source account and Region for each widget; the dashboard page itself being global does not combine metrics automatically.

For a Network Manager view, open the intended global network, choose Transit Gateway network, then select the Monitoring tab and the transit gateway to inspect. Check its account, Region, and time range. The dashboard only includes transit gateways registered with that global network. AWS's Network Manager monitoring instructions also note that adding a transit gateway metric to a CloudWatch dashboard is supported only when the registered transit gateway is in US West (Oregon).

Network Manager events and metrics are separate views. If the Events tab has no data, verify the event time range and whether CloudWatch Logs Insights onboarding has been completed for the global network.

3. Match permissions to the failed operation

Use the error message or denied API action to check the permission that is actually missing. Viewing a CloudWatch dashboard requires dashboard read actions; loading its metric widgets can additionally require metric read actions, and a Logs Insights widget requires CloudWatch Logs query access. Network Manager views read Network Manager, EC2, and CloudWatch data, so an identity that can open the service may still lack access to one of those resources.

Ask an administrator to make the smallest policy change that allows the intended read operation. Avoid replacing a restricted role with broad administrator access to diagnose a missing graph.

4. Isolate a slow widget or delayed source

Temporarily compare a single widget over a shorter time range, then restore the dashboard after the comparison. This can show whether delay is limited to one query or affects the entire page. Check whether automatic refresh, many metrics, or a broad log query is involved, and compare the result with the source metric or log group.

Do not use off-peak timing as a substitute for checking metric cadence. Choose a period that matches how the service publishes the metric, and use a shorter interval only when that source provides data at that resolution.

Trace network traffic when metrics are not enough

Check Network Manager and transit gateway scope

AWS Network Manager is for visualizing and monitoring a configured global network. If its maps, topology, or metrics are empty, confirm that the global network exists, the expected transit gateway is registered, and the selected account and gateway are correct. A multi-account view requires the appropriate Network Manager setup and permissions. For a focused walkthrough, see Visualize AWS Transit Gateways with Network Manager.

Network Manager's Route Analyzer checks routes in Transit Gateway route tables. Its Monitoring tab shows transit gateway bytes and packets in and out, plus bytes and packets dropped for black-hole routes or missing routes; it does not provide a general application-latency measurement. Use a latency metric or trace from the service that owns the request path. The Route Analyzer does not replace CloudWatch metrics or VPC Flow Logs, and a route result should be read in the context of the selected source and destination attachments.

Review VPC Flow Logs in CloudWatch Logs

VPC Flow Logs record IP traffic for the VPC, subnet, or network interface where you enabled them. They do not populate CloudWatch metrics automatically. If you need to inspect records in Logs Insights, confirm that the Flow Log destination is CloudWatch Logs, its delivery status is healthy, and the selected time range includes traffic. New flow logs can take several minutes to begin publishing; AWS notes that a log group may not appear until traffic has been recorded. See AWS's guides to Flow Logs behavior and Flow Logs delivery troubleshooting.

For a default-format log group, this Logs Insights query looks for rejected records, using the fields in AWS's CloudWatch Logs Flow Logs search instructions. If you chose a custom record format, use the field names included in that format:

fields @timestamp, interfaceId, srcAddr, dstAddr, srcPort, dstPort, action, logStatus
| filter action = 'REJECT'
| sort @timestamp desc
| limit 50

A REJECT record can indicate a security group or network ACL denial, but it can also mean that packets arrived after a connection closed. Correlate the interface, direction, addresses, ports, timestamps, and log status before changing rules. Flow Logs are aggregated and delivered on a best-effort basis, so they are not a real-time packet trace and do not capture every type of IP traffic. Flow Logs are IP-flow records, not measurements of request or round-trip latency. Read the current record definitions, CloudWatch Logs search instructions, and Flow Logs limitations.

Escalate with evidence

If the issue persists, gather the AWS account and Region, dashboard and widget name, affected resource IDs, incident times in UTC, metric namespace/name/dimensions, relevant request or error IDs, and Flow Logs delivery status. For a reachability problem, include the analyzer path and the component it identified. Remove credentials, tokens, and sensitive packet or application data from screenshots and logs before sharing them.

Choose a diagnostic tool that matches the question

Use an analyzer for configuration-level connectivity

Use VPC Reachability Analyzer when you need to inspect whether the current network configuration allows a defined path between supported VPC resources. It reports the path or the blocking configuration component, but it does not send packets or test the application data plane. Pair its result with a live connection test and application logs when diagnosing an outage. See AWS's explanation of how Reachability Analyzer works. For a VPC endpoint connection problem, continue with the site's VPC endpoint troubleshooting guide.

Add a custom metric only for a missing signal

CloudWatch dashboards display metrics; they do not create them. Use a service's published metrics when they measure the signal you need. A custom metric is appropriate when you have an application or network measurement that AWS does not publish for your use case, and a reliable process to publish it. Define what the value means, its unit, dimensions, resolution, and owner first. Review current CloudWatch pricing and metric-cardinality implications before adding it.

Alert on a defined metric or event

Use a CloudWatch alarm for a metric threshold that indicates an actionable condition, and choose its period to match the metric's publication rate. Decide explicitly how missing data should affect the alarm: a missing point is not the same as a measured value of zero. Use EventBridge for AWS Health or Network Manager events when event-based routing is the goal. Test the notification path and confirm that the receiving team knows what action to take.

Keep the dashboard tied to observable signals

When network data looks wrong, first identify whether the page is CloudWatch, Network Manager, or AWS Health. Then check account, Region, time range, source metric or event, and permissions. Use VPC Flow Logs for IP-flow records, CloudWatch for service-published metrics and alarms, Network Manager for registered transit gateway networks, and Reachability Analyzer for supported configuration paths. These tools answer different questions; a clear view in one does not establish that every layer of the workload is healthy.

FAQs

What should I check first when an AWS network chart is empty?

Confirm which dashboard is open, then verify the AWS account, Region, time range, resource, metric or event source, dimensions, and read permissions. For CloudWatch metrics, query the exact metric directly. For Network Manager, confirm the transit gateway is registered in the selected global network. For VPC Flow Logs, confirm there is traffic, the destination and delivery role are correct, and allow time for records to arrive.