Aviatrix review

Aviatrix is a network containment platform for cloud and AI workloads. Its Clearance product uses default-deny policies enforced in the network, so workloads can reach only approved destinations and other workloads. The product description says Clearance requires no installation.

The controls cover outbound traffic to internet destinations by domain and workload-to-workload access across VPCs and clouds by identity. For Kubernetes, policies follow pods rather than node addresses and govern egress through node NAT. Aviatrix also says it can discover AI agents from flow and DNS data, including agents that were not authorized.

Active Defense drafts policies and checks them in monitor mode. It is in free early access for design partners on Aviatrix Enterprise, not presented as a generally available free plan. The basic pitch is containment at the network layer, rather than relying only on controls installed inside each workload.

Aviatrix’s feature set maps to a real gap in cloud controls: teams need to limit both what workloads can reach on the internet and which other workloads they can contact. Clearance’s default-deny approach makes approved destinations the exception, rather than allowing broad access and trying to spot bad traffic afterward.

The strongest parts of the offer are:

• Outbound containment: The product description says teams can restrict internet destinations by domain without putting a central firewall in the traffic path.
• Lateral containment: Policies control workload-to-workload access by identity across VPCs and clouds, not just at a single network boundary.
• Kubernetes coverage: Policies follow pods instead of node addresses and govern egress through node NAT.
• AI workload discovery: Flow and DNS data can reveal agents, including ones that were not authorized.
• Policy preparation: Active Defense drafts policies and checks them in monitor mode before enforcement; access is limited to free early access for design partners on Enterprise.

That breadth could matter for teams trying to apply consistent controls across mixed cloud environments. The trade-off is that feature breadth alone does not establish lower cost or easier operations.

The biggest buying problem is price opacity. The pricing information lists no monthly or annual rates, and commercial contracts are quote-based. It describes a custom-scoped Enterprise / Commercial offer whose consumption depends on nodes, VPCs/VNETs and edge connections, but publishes no unit price or numeric caps. There is no free plan; the listed 30-day marketplace trial is the only general trial detail. Active Defense’s free early access is limited to design partners on Enterprise.

That makes cost comparison difficult before a sales conversation, particularly if your footprint changes. Ask for a quote that shows how each consumption measure affects the bill and what happens as usage grows; those terms are not published on the vendor's site.

Operations also deserve scrutiny if you are considering Aviatrix as a NAT Gateway replacement. In one Reddit thread, users reported difficulty managing Aviatrix instances and raised patching, maintenance and scaling concerns, including EC2 capacity limits. These are user reports, not proof that every deployment has those problems, but they are relevant costs to validate alongside any projected savings. One commenter also cautioned against assuming Aviatrix traffic coverage makes VPC flow logs unnecessary.

Aviatrix does not publish a list price for its Enterprise / Commercial offering. According to the published pricing information, contracts are quote-based, with consumption based on nodes, VPCs or VNETs, and edge connections. Monthly and annual rates are not published, so buyers cannot calculate a reliable total from public pricing alone.

There is no published tier-by-tier price jump to compare: the listed offering is a custom-scoped commercial contract. The pricing data lists a 30-day marketplace free trial, but no free plan. It does not list paid add-ons; that is not confirmation that a quote cannot include additional charges.

Before signing, ask Aviatrix to price your expected node, network, and edge-connection counts, and to explain how changes in those counts affect billing. Confirm what the trial covers and whether production use, support, or implementation costs are included. The available pricing information is low-confidence, so treat any estimate as provisional until it appears in a written quote.

Treat a move to Aviatrix as a network-policy project, not just a product swap. Clearance uses default-deny rules, and its controls cover outbound destinations, workload-to-workload access, and Kubernetes egress. Teams should inventory required destinations and workload relationships, then plan to validate policies before enforcement. The published product details say Active Defense can draft policies and check them in monitor mode, but it is in free early access for design partners on Aviatrix Enterprise; confirm availability for your contract.

Before switching in either direction, ask for a documented policy export and a clear account of what configuration can be reused elsewhere. The published information does not specify export formats, migration tooling, or how policies map to another platform, so those are vendor questions—not assumed capabilities. The contract is custom-scoped, and consumption is based on nodes, VPCs/VNETs, and edge connections; include those counts in any exit or replacement estimate.

We have no Reddit posts or comments in the published material, so we can’t substantiate community-reported reasons for leaving Aviatrix.