AWS AWSCloudFormation documentation change
Summary
Added NDI configuration notes, clarified VPC interface immutability, and simplified subnet/Security Group documentation
Security assessment
Changes focus on operational constraints and configuration guidance. While security groups and IAM roles are mentioned, these are existing security features being clarified rather than new security documentation or vulnerability fixes.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-mediaconnect-flow-vpcinterface.md b/AWSCloudFormation/latest/UserGuide/aws-properties-mediaconnect-flow-vpcinterface.md index 4d792389a..7f9840a75 100644 --- a/AWSCloudFormation/latest/UserGuide/aws-properties-mediaconnect-flow-vpcinterface.md +++ b/AWSCloudFormation/latest/UserGuide/aws-properties-mediaconnect-flow-vpcinterface.md @@ -8,0 +9,13 @@ The details of a VPC interface. +###### Note + +When configuring VPC interfaces for NDI outputs, keep in mind the following: + + * VPC interfaces must be defined as nested attributes within the `AWS::MediaConnect::Flow` resource, and not within the top-level `AWS::MediaConnect::FlowVpcInterface` resource. + + * There's a maximum limit of three VPC interfaces for each flow. If you've already reached this limit, you can't update the flow to use a different VPC interface without first removing an existing one. + +To update your VPC interfaces in this scenario, you must first remove the VPC interface that’s not being used. Next, add the new VPC interfaces. Lastly, update the `VpcInterfaceAdapter` in the `NDIConfig` property. These changes must be performed as separate manual operations and cannot be done through a single template update. + + + + @@ -44 +57 @@ To declare this entity in your AWS CloudFormation template, use the following sy -The name for the VPC interface. This name must be unique within the flow. +Immutable and has to be a unique against other VpcInterfaces in this Flow. @@ -55 +68 @@ _Required_ : Yes -The IDs of the network interfaces that MediaConnect created in your account. +IDs of the network interfaces created in customer's account by MediaConnect. @@ -79 +92 @@ _Required_ : No -The ARN of the IAM role that you created when you set up MediaConnect as a trusted service. +A role Arn MediaConnect can assume to create ENIs in your account. @@ -90 +103 @@ _Required_ : Yes -A virtual firewall to control inbound and outbound traffic. +Security Group IDs to be used on ENI. @@ -101,5 +114 @@ _Required_ : Yes -The subnet IDs that you specified for your VPC interface. - -A subnet ID is a range of IP addresses in your VPC. When you create your VPC, you specify a range of IPv4 addresses for the VPC in the form of a Classless Inter-Domain Routing (CIDR) block; for example, 10.0.0.0/16. This is the primary CIDR block for your VPC. When you create a subnet for your VPC, you specify the CIDR block for the subnet, which is a subset of the VPC CIDR block. - -The subnets that you use across all VPC interfaces on the flow must be in the same Availability Zone as the flow. +Subnet must be in the AZ of the Flow.