AWS AWSCloudFormation documentation change
Summary
Added NDI configuration guidance, rephrased security group description as a firewall, and consolidated subnet ID documentation
Security assessment
The change enhances security documentation by explicitly describing security groups as a virtual firewall and provides operational guidance to prevent misconfigurations, but lacks evidence of addressing a specific security incident
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-resource-mediaconnect-flowvpcinterface.md b/AWSCloudFormation/latest/UserGuide/aws-resource-mediaconnect-flowvpcinterface.md index e94f0549e..8572e6be6 100644 --- a/AWSCloudFormation/latest/UserGuide/aws-resource-mediaconnect-flowvpcinterface.md +++ b/AWSCloudFormation/latest/UserGuide/aws-resource-mediaconnect-flowvpcinterface.md @@ -7 +7 @@ SyntaxPropertiesReturn values -The AWS::MediaConnect::FlowVpcInterface resource is a connection between your AWS Elemental MediaConnect flow and a virtual private cloud (VPC) that you created using the Amazon Virtual Private Cloud service. +The `AWS::MediaConnect::FlowVpcInterface` resource is a connection between your AWS Elemental MediaConnect flow and a virtual private cloud (VPC) that you created using the Amazon Virtual Private Cloud service. @@ -22 +22 @@ You can update an existing flow to add a VPC interface. If you haven’t created -###### Note +###### Important @@ -25,0 +26,4 @@ The previous steps must be undone before the CloudFormation stack can be deleted +###### Note + +When configuring NDI outputs for your flow, define the VPC interface as a nested attribute within the `AWS::MediaConnect::Flow` resource. Do not use the top-level `AWS::MediaConnect::FlowVpcInterface` resource type to specify NDI configurations. + @@ -74 +78 @@ _Required_ : Yes -The name of the VPC Interface. This value must be unique within the current flow. +The name for the VPC interface. This name must be unique within the flow. @@ -96 +100 @@ _Required_ : Yes -The VPC security groups that you want MediaConnect to use for your VPC configuration. You must include at least one security group in the request. +A virtual firewall to control inbound and outbound traffic. @@ -107,5 +111 @@ _Required_ : Yes -The subnet IDs that you want to use for your VPC interface. - -A range of IP addresses in your VPC. When you create your VPC, you specify a range of IPv4 addresses for the VPC in the form of a Classless Inter-Domain Routing (CIDR) block; for example, 10.0.0.0/16. This is the primary CIDR block for your VPC. When you create a subnet for your VPC, you specify the CIDR block for the subnet, which is a subset of the VPC CIDR block. - -The subnets that you use across all VPC interfaces on the flow must be in the same Availability Zone as the flow. +The subnet IDs that you want to use for your VPC interface. A range of IP addresses in your VPC. When you create your VPC, you specify a range of IPv4 addresses for the VPC in the form of a Classless Inter-Domain Routing (CIDR) block; for example, 10.0.0.0/16. This is the primary CIDR block for your VPC. When you create a subnet for your VPC, you specify the CIDR block for the subnet, which is a subset of the VPC CIDR block. The subnets that you use across all VPC interfaces on the flow must be in the same Availability Zone as the flow.