Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Security groups, network ACLs, and routes show what may be reachable; Network Scanning probes from the internet and reports reachability observed at scan time.
- Each reachable port produces a Security Hub finding with port and service evidence; Security Hub Exposures can correlate it with other findings and resource configurations for broader context.
- The current user guide lists AWS EC2 instances with public IPs, Elastic IPs, and load balancers, and specifies a limited set of common TCP ports. It does not resolve the GovCloud documentation conflict with a complete Region-specific matrix.
- The announcement says the feature is included in Security Hub Essentials at no additional cost in supported commercial and GovCloud (US) Regions. That is not a promise that all AWS usage is free.
What scanning confirms beyond configuration
Security groups, network access control lists (network ACLs), and route tables can show what traffic a configuration may allow; they do not prove that a service is reachable from the internet. Network Scanning probes public resources from the internet to check actual reachability and the service running on a reachable port. It complements Security Hub's existing network reachability findings and provides evidence within its scan coverage.
In an announcement published on November 5, 2026, AWS said the feature is now supported in GovCloud (US). The announcement describes discovery of public IP addresses, virtual machines, and load balancers, followed by identification of reachable ports and services. Each reachable port generates a Security Hub finding with port and service evidence. Security Hub Exposures then correlates findings with other findings and resource configurations to provide broader risk context.
What one finding, or no finding, means
A reachable-port finding represents one reachable port on a specific resource and address, with evidence collected during the scan. For intermittently reachable ports, the current user guide says findings are based on positive evidence at scan time. A finding records that observation; it does not mean the port will remain reachable or that every other port was checked.
When the scanner detects no open ports on a resource, the guide says it creates an Informational finding: the scanner checked the ports it currently supports, and that finding requires no action. By contrast, the guide says that no finding for a supported resource type means the resource has not been scanned yet. Absence of a finding is not proof that a resource was verified as unreachable from the internet. First check feature status, resource support, and whether a scan has occurred.
Resource types and ports have defined limits
The current user guide lists these AWS resource types: EC2 instances with public IPs, Elastic IPs (EIPs), Network Load Balancers, Application Load Balancers, and Classic Load Balancers. The GovCloud announcement gives only higher-level categories: public IP addresses, virtual machines, and load balancers. Because the same guide still lists only commercial AWS Regions, it does not establish that every detailed resource type is covered in every GovCloud Region.
The guide lists 20 common TCP ports, and an Informational no-open-ports finding covers only ports the scanner currently supports. This is not a guarantee that all 65,535 TCP ports, all other ports, or every protocol were checked. The announcement does not provide a GovCloud-specific resource and port matrix. Before using a result for coverage planning, verify what the target account and Region currently support.
GovCloud availability and default status need checking
AWS's November 5 announcement says Network Scanning is now supported in GovCloud (US). It says existing customers can enable it per account and Region or manage it across an organization through a configuration policy; it also says the feature is on by default for new Security Hub customers. The announcement does not enumerate Regions or establish the current status of a particular account.
The current AWS Security Hub User Guide still calls Network Scanning an opt-in feature and lists availability in commercial Regions where Security Hub is available. The two sources conflict on GovCloud scope and the default for new customers. Do not assume every GovCloud account is ready or that the feature is always on by default. Check the specific account and Region's feature status and current official guidance read-only; do not use an enable action as an availability test.
No additional scanning fee is a narrow claim
AWS's announcement says Network Scanning is included with Security Hub Essentials at no additional cost in commercial and GovCloud (US) Regions that support Security Hub. That fee statement depends on the feature and Region being supported; it does not replace checking eligibility and the service plan for the account you use.
“No additional cost for the scanning feature” does not mean Security Hub, other AWS services, or the full cloud environment is free. Before budgeting or adopting it, confirm the current scope in the target account's and Region's product information and billing details. A reachability finding also answers only what was observed at that time within the scanner's coverage; it is not a complete security guarantee.
Sources
Frequently Asked Questions
Does scanning a load balancer also scan every instance behind it?
The current guide says the scanner resolves and scans the load balancer DNS name. It scans an EC2 instance behind it separately only if that instance has its own public IP or EIP. A load balancer finding does not establish that every backend instance was checked; the guide still does not provide a GovCloud resource-by-resource coverage matrix.
Will a finding close immediately after I close the exposed port?
The guide says a subsequent scan must confirm that the port is unreachable before the finding closes. It describes rescanning active resources roughly every 12 hours, which is not a promise of immediate updates or a deadline. The guide and announcement still differ on GovCloud scope, and a GovCloud-specific rescan interval has not been verified here.