AWS vpc documentation change
Summary
Restructured content with added 'Internet gateway basics' section, clarified routing/NAT details, added comparison table for default vs nondefault VPC internet access components, and updated headings
Security assessment
Changes focus on organizational improvements and clarifying existing functionality. No mention of vulnerabilities, exploits, or security mitigations. NAT explanation is part of standard networking documentation.
Diff
diff --git a/vpc/latest/userguide/VPC_Internet_Gateway.md b/vpc/latest/userguide/VPC_Internet_Gateway.md index 6162a1dd3..0f248a6e1 100644 --- a/vpc/latest/userguide/VPC_Internet_Gateway.md +++ b/vpc/latest/userguide/VPC_Internet_Gateway.md @@ -5 +5,3 @@ -# Enable VPC internet access using internet gateways +Internet gateway basics + +# Enable internet access for a VPC using an internet gateway @@ -11 +13 @@ An internet gateway enables resources in your public subnets (such as EC2 instan -An internet gateway provides a target in your VPC route tables for internet-routable traffic. For communication using IPv4, the internet gateway also performs network address translation (NAT). For more information, see [IP addresses and NAT](./vpc-igw-internet-access.html#ip-addresses-and-nat). +An internet gateway provides a target in your VPC route tables for internet-routable traffic. For communication using IPv4, the internet gateway also performs network address translation (NAT). For more information, see IP addresses and NAT. @@ -13 +15 @@ An internet gateway provides a target in your VPC route tables for internet-rout -###### Note +###### Pricing @@ -19 +21 @@ There is no charge for an internet gateway, but there are data transfer charges - * [Configuration for internet access](./vpc-igw-internet-access.html) + * Internet gateway basics @@ -22,0 +25,28 @@ There is no charge for an internet gateway, but there are data transfer charges + * [Delete an internet gateway](./delete-igw.html) + + + + +## Internet gateway basics + +To use an internet gateway, you must attach it to a VPC and configure routing. + +###### Routing configuration + +If a subnet is associated with a route table that has a route to an internet gateway, it's known as a _public subnet_. If a subnet is associated with a route table that does not have a route to an internet gateway, it's known as a _private subnet_. + +In your public subnet's route table, you can specify a route for the internet gateway to all destinations not explicitly known to the route table (0.0.0.0/0 for IPv4 or ::/0 for IPv6). Alternatively, you can scope the route to a narrower range of IP addresses; for example, the public IPv4 addresses of your company’s public endpoints outside of AWS, or the Elastic IP addresses of other Amazon EC2 instances outside your VPC. + +###### Internet gateway diagram + +In the following diagram, the subnet in Availability Zone A is a public subnet because its route table has a route that sends all internet-bound IPv4 traffic to the internet gateway. The instances in the public subnet must have public IP addresses or Elastic IP addresses to enable communication with the internet over the internet gateway. For comparison, the subnet in Availability Zone B is a private subnet because its route table does not have a route to the internet gateway. Because there is no route to the internet gateway, instances in the private subnet can't communicate with the internet, even if they have public IP addresses. + + + +###### IP addresses and NAT + +To enable communication over the internet for IPv4, your instance must have a public IPv4 address. You can either configure your VPC to automatically assign public IPv4 addresses to your instances, or you can assign Elastic IP addresses to your instances. Your instance is only aware of the private (internal) IP address space defined within the VPC and subnet. The internet gateway logically provides the one-to-one NAT on behalf of your instance, so that when traffic leaves your VPC subnet and goes to the internet, the reply address field is set to the public IPv4 address or Elastic IP address of your instance, and not its private IP address. Conversely, traffic that's destined for the public IPv4 address or Elastic IP address of your instance has its destination address translated into the instance's private IPv4 address before the traffic is delivered to the VPC. + +To enable communication over the internet for IPv6, your VPC and subnet must have an associated IPv6 CIDR block, and your instance must be assigned an IPv6 address from the range of the subnet. IPv6 addresses are globally unique, and therefore public by default. + +###### Internet access for default and nondefault VPCs @@ -23,0 +54 @@ There is no charge for an internet gateway, but there are data transfer charges +The following table provides an overview of whether your VPC automatically comes with the components required for internet access over IPv4 or IPv6. @@ -24,0 +56,7 @@ There is no charge for an internet gateway, but there are data transfer charges +Component | Default VPC | Nondefault VPC +---|---|--- +Internet gateway | Yes | No +Route table with route to internet gateway for IPv4 traffic (0.0.0.0/0) | Yes | No +Route table with route to internet gateway for IPv6 traffic (::/0) | No | No +Public IPv4 address automatically assigned to instance launched into subnet | Yes (default subnet) | No (nondefault subnet) +IPv6 address automatically assigned to instance launched into subnet | No (default subnet) | No (nondefault subnet) @@ -34 +72 @@ Connect your VPC -Configuration for internet access +Create an internet gateway