AWS directconnect documentation change
Summary
Updated documentation to provide more detailed guidance on IP address configuration for Direct Connect virtual interfaces, including references to RFC 1918 and RFC 3927, and recommendations for using loopback or LAN interfaces for VPC traffic.
Security assessment
The changes provide more detailed technical guidance but do not address any specific security vulnerabilities or introduce new security features.
Diff
diff --git a/directconnect/latest/UserGuide/create-hosted-transit-vif.md index 8fe74c59b..565d52366 100644 --- a/directconnect/latest/UserGuide/create-hosted-transit-vif.md +++ b/directconnect/latest/UserGuide/create-hosted-transit-vif.md @@ -47 +47,5 @@ The valid values are 1-2147483647. -If you let AWS auto-assign IP addresses, a /29 CIDR will be allocated from 169.254.0.0/16. AWS does not recommend this option if you intend to use the customer router peer IP address as the source and destination for traffic. Instead you should use RFC 1918 or other addressing, and specify the address yourself. For more information about RFC 1918 see [ Address Allocation for Private Internets](https://datatracker.ietf.org/doc/html/rfc1918). +When configuring AWS Direct Connect virtual interfaces, you can specify your own IP addresses using RFC 1918, use other addressing schemes, or opt for AWS assigned IPv4 /29 CIDR addresses allocated from the RFC 3927 169.254.0.0/16 IPv4 Link-Local range for point-to-point connectivity. These point-to-point connections should be used exclusively for eBGP peering between your customer gateway router and the Direct Connect endpoint. For VPC traffic or tunnelling purposes, such as AWS Site-to-Site Private IP VPN, or Transit Gateway Connect, AWS recommends using a loopback or LAN interface on your customer gateway router as the source or destination address instead of the point-to-point connections. + + * For more information about RFC 1918, see [Address Allocation for Private Internets](https://datatracker.ietf.org/doc/html/rfc1918). + + * For more information about RFC 3927, see [Dynamic Configuration of IPv4 Link-Local Addresses](https://datatracker.ietf.org/doc/html/rfc3927).