AWS vpc documentation change
Summary
Restructured internet gateway setup steps, added route table configuration details, and clarified requirements for public IPs/security groups. Added NAT device alternative recommendation.
Security assessment
Changes focus on procedural clarity and completeness (e.g., adding route table configuration). While security groups and NAT devices are mentioned, these are standard architectural considerations rather than responses to specific vulnerabilities.
Diff
diff --git a/vpc/latest/userguide/working-with-igw.md b/vpc/latest/userguide/working-with-igw.md index 713535275..4a416922e 100644 --- a/vpc/latest/userguide/working-with-igw.md +++ b/vpc/latest/userguide/working-with-igw.md @@ -5 +5 @@ -1\. Create an internet gateway2\. Attach or detach an internet gateway from a VPC3\. Delete an internet gatewayCommand line overview +Step 1: Create an internet gatewayStep 2: Attach the internet gateway to the VPCStep 3: Add a route to the subnet route table @@ -9 +9 @@ -The following describes how to support internet access from a subnet in your VPC using an internet gateway. To remove internet access, you can detach the internet gateway from your VPC and then delete it. +The following describes how to support internet access from a subnet in a nondefault VPC using an internet gateway. You must create the internet gateway, attach it to the VPC, and configure routing for the subnet. @@ -11 +11,3 @@ The following describes how to support internet access from a subnet in your VPC -###### Tasks +After you configure internet access for your subnet, you must ensure that resources in the subnet can access the internet. For example, your EC2 instances must have a public IPv4 or IPv6 address, and the security groups for your instances must allow specific traffic to and from the internet. + +Alternatively, to provide your instances with internet access without assigning them a public IP address, use a NAT device instead. For more information, see [NAT devices](./vpc-nat.html). @@ -13 +15,3 @@ The following describes how to support internet access from a subnet in your VPC - * 1\. Create an internet gateway +To remove internet access, you can detach the internet gateway from your VPC and then delete it. For more information, see [Delete an internet gateway](./delete-igw.html). + +###### Tasks @@ -15 +19 @@ The following describes how to support internet access from a subnet in your VPC - * 2\. Attach or detach an internet gateway from a VPC + * Step 1: Create an internet gateway @@ -17 +21 @@ The following describes how to support internet access from a subnet in your VPC - * 3\. Delete an internet gateway + * Step 2: Attach the internet gateway to the VPC @@ -19 +23 @@ The following describes how to support internet access from a subnet in your VPC - * Command line overview + * Step 3: Add a route to the subnet route table @@ -24 +28 @@ The following describes how to support internet access from a subnet in your VPC -## 1\. Create an internet gateway +## Step 1: Create an internet gateway @@ -28 +32 @@ Use the following procedure to create an internet gateway. -###### To create an internet gateway +###### To create an internet gateway using the console @@ -47,13 +51 @@ Use the following procedure to create an internet gateway. -## 2\. Attach or detach an internet gateway from a VPC - -To use an internet gateway, you must attach it to a VPC. - -If you no longer need internet access for instances that you launch into a VPC, you can detach an internet gateway from a VPC. You can't detach an internet gateway if the VPC has resources with associated public IP addresses or Elastic IP addresses. - -###### To attach or detach an internet gateway to a VPC - - 1. Open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). - - 2. In the navigation pane, choose **Internet gateways**. - - 3. Select the check box for the internet gateway. +###### To create an internet gateway using the command line @@ -61 +53 @@ If you no longer need internet access for instances that you launch into a VPC, - 4. To attach it, choose **Actions** , Attach to VPC, select an available VPC, and choose **Attach internet gateway**. + * [create-internet-gateway](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-internet-gateway.html) (AWS CLI) @@ -63 +55 @@ If you no longer need internet access for instances that you launch into a VPC, - 5. To detach it, choose **Actions** , **Detach from VPC** and choose **Detach internet gateway**. When prompted for confirmation, choose **Detach internet gateway**. + * [New-EC2InternetGateway](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2InternetGateway.html) (AWS Tools for Windows PowerShell) @@ -68 +60 @@ If you no longer need internet access for instances that you launch into a VPC, -## 3\. Delete an internet gateway +## Step 2: Attach the internet gateway to the VPC @@ -70 +62 @@ If you no longer need internet access for instances that you launch into a VPC, -If you no longer need an internet gateway, you can delete it. You can't delete an internet gateway if it's still attached to a VPC. +To use an internet gateway, you must attach it to a VPC. @@ -72 +64 @@ If you no longer need an internet gateway, you can delete it. You can't delete a -###### To delete an internet gateway +###### To attach an internet gateway to a VPC using the console @@ -80,14 +72 @@ If you no longer need an internet gateway, you can delete it. You can't delete a - 4. Choose **Actions** , **Delete internet gateway**. - - 5. When prompted for confirmation, enter `delete`, and then choose **Delete internet gateway**. - - - - -## Command line overview - -You can perform the tasks described on this page using the command line. - -###### Create an internet gateway - - * [create-internet-gateway](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-internet-gateway.html) (AWS CLI) + 4. To attach it, choose **Actions** , Attach to VPC, select an available VPC, and choose **Attach internet gateway**. @@ -95 +74 @@ You can perform the tasks described on this page using the command line. - * [New-EC2InternetGateway](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2InternetGateway.html) (AWS Tools for Windows PowerShell) + 5. To detach it, choose **Actions** , **Detach from VPC** and choose **Detach internet gateway**. When prompted for confirmation, choose **Detach internet gateway**. @@ -100 +79 @@ You can perform the tasks described on this page using the command line. -###### Attach an internet gateway to a VPC +###### To attach an internet gateway to a VPC using the command line @@ -109 +88 @@ You can perform the tasks described on this page using the command line. -###### Describe an internet gateway +## Step 3: Add a route to the subnet route table @@ -111 +90 @@ You can perform the tasks described on this page using the command line. - * [describe-internet-gateways](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-internet-gateways.html) (AWS CLI) +The route table for the subnet must have a route that sends internet traffic to the internet gateway. @@ -113 +92 @@ You can perform the tasks described on this page using the command line. - * [Get-EC2InternetGateway](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2InternetGateway.html) (AWS Tools for Windows PowerShell) +###### To configure the subnet route table using the console @@ -114,0 +94 @@ You can perform the tasks described on this page using the command line. + 1. Open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). @@ -115,0 +96 @@ You can perform the tasks described on this page using the command line. + 2. In the navigation pane, choose **Route tables**. @@ -116,0 +98 @@ You can perform the tasks described on this page using the command line. + 3. Select the route table for the subnet. By default, a subnet uses the main route table for the VPC. Alternatively, you can [create a custom route table](./WorkWithRouteTables.html#CustomRouteTable) and then [associate the subnet with the new route table](./WorkWithRouteTables.html#AssociateSubnet). @@ -118 +100 @@ You can perform the tasks described on this page using the command line. -###### Detach an internet gateway from a VPC + 4. On the **Routes** tab, choose **Edit routes** and then choose **Add route**. @@ -120 +102 @@ You can perform the tasks described on this page using the command line. - * [detach-internet-gateway](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/detach-internet-gateway.html) (AWS CLI) + 5. Enter 0.0.0.0/0 for **Destination** and select the internet gateway for **Target**. @@ -122 +104 @@ You can perform the tasks described on this page using the command line. - * [Dismount-EC2InternetGateway](https://docs.aws.amazon.com/powershell/latest/reference/items/Dismount-EC2InternetGateway.html) (AWS Tools for Windows PowerShell) + 6. Choose **Save changes**. @@ -127 +109 @@ You can perform the tasks described on this page using the command line. -###### Delete an internet gateway +###### To configure the subnet route table using the command line @@ -129 +111 @@ You can perform the tasks described on this page using the command line. - * [delete-internet-gateway](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-internet-gateway.html) (AWS CLI) + * [create-route](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-route.html) (AWS CLI) @@ -131 +113 @@ You can perform the tasks described on this page using the command line. - * [Remove-EC2InternetGateway](https://docs.aws.amazon.com/powershell/latest/reference/items/Remove-EC2InternetGateway.html) (AWS Tools for Windows PowerShell) + * [New-EC2Route](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2Route.html) (AWS Tools for Windows PowerShell) @@ -142 +124 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Configuration for internet access +Internet gateways @@ -144 +126 @@ Configuration for internet access -Egress-only internet gateways +Delete an internet gateway