AWS amazondynamodb documentation change
Summary
Added documentation for AWS PrivateLink support for DynamoDB Streams endpoints, updated CLI examples, fixed typos, and added reliability recommendation
Security assessment
The change adds documentation about AWS PrivateLink support for DynamoDB Streams, which is a security feature that keeps network traffic within AWS infrastructure. However, there is no evidence this addresses a specific security vulnerability.
Diff
diff --git a/amazondynamodb/latest/developerguide/privatelink-interface-endpoints.md b/amazondynamodb/latest/developerguide/privatelink-interface-endpoints.md index 1491705f6..f05fcebc5 100644 --- a/amazondynamodb/latest/developerguide/privatelink-interface-endpoints.md +++ b/amazondynamodb/latest/developerguide/privatelink-interface-endpoints.md @@ -11 +11 @@ With AWS PrivateLink for DynamoDB, you can provision _interface Amazon VPC endp -Applications in your VPC do not need public IP addresses to communicate with DynamoDB interface VPC endpoints for DynamoDB operations. Interface endpoints are represented by one or more elastic network interfaces (ENIs) that are assigned private IP addresses from subnets in your Amazon VPC. Requests to DynamoDB over interface endpoints stay on the Amazon network. You can also access interface endpoints in your Amazon VPC from on-premises applications through AWS Direct Connect or AWS Virtual Private Network (AWS VPN). For more information about how to connect your Amazon VPC with your on-premises network, see the [AWS Direct Connect User Guide](https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html) and the [AWS Site-to-Site VPN User Guide](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html). +Applications in your VPC do not need public IP addresses to communicate with DynamoDB using VPC interface endpoints for DynamoDB operations. Interface endpoints are represented by one or more elastic network interfaces (ENIs) that are assigned private IP addresses from subnets in your Amazon VPC. Requests to DynamoDB over interface endpoints stay on the Amazon network. You can also access interface endpoints in your Amazon VPC from on-premises applications through AWS Direct Connect or AWS Virtual Private Network (AWS VPN). For more information about how to connect your Amazon VPC with your on-premises network, see the [AWS Direct Connect User Guide](https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html) and the [AWS Site-to-Site VPN User Guide](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html). @@ -13 +13 @@ Applications in your VPC do not need public IP addresses to communicate with Dyn -For general information about interface endpoints, see [Interface Amazon VPC endpoints (AWS PrivateLink)](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html) in the _AWS PrivateLink Guide_. +For general information about interface endpoints, see [Interface Amazon VPC endpoints (AWS PrivateLink)](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html) in the _AWS PrivateLink Guide_. AWS PrivateLink is also supported for Amazon DynamoDB Streams endpoints. For more information, see [AWS PrivateLink for DynamoDB Streams](./privatelink-streams.html). @@ -30,0 +31,2 @@ For general information about interface endpoints, see [Interface Amazon VPC end + * [AWS PrivateLink for DynamoDB Streams](./privatelink-streams.html) + @@ -63,2 +64,0 @@ AWS PrivateLink for Amazon DynamoDB does not support the following: -AWS PrivateLink is currently not supported for Amazon DynamoDB Streams endpoints. - @@ -77 +77 @@ To create an Amazon VPC interface endpoint, see [ Create an Amazon VPC endpoint] -When you create an interface endpoint, DynamoDB generates two types of endpoint-specific, DynamoDB DNS names: _Regional_ and _zonal_. +When you create an interface endpoint, DynamoDB generates two types of endpoint-specific, DynamoDB DNS names: _Regional_ and _Zonal_. @@ -86 +86,3 @@ When you create an interface endpoint, DynamoDB generates two types of endpoint- -Endpoint-specific DynamoDB DNS names can be resolved from the DynamoDB public DNS domain. +###### Note + +To achieve optimal reliability, we recommend deploying your service across a minimum of three availability zones. @@ -101 +103 @@ To access DynamoDB tables or DynamoDB control API operations through DynamoDB in - ----service-name dynamodb \ + --service-name com.amazonaws.us-east-1.dynamodb \ @@ -123 +125 @@ In the following example, replace the Region `us-east-1` and the DNS name of the - aws dynamodb --region us-east-1 —endpoint https://vpce-1a2b3c4d-5e6f.dynamodb.us-east-1.vpce.amazonaws.com list-tables + aws dynamodb --region us-east-1 --endpoint https://vpce-1a2b3c4d-5e6f.dynamodb.us-east-1.vpce.amazonaws.com list-tables @@ -263 +265 @@ Infrastructure security -Configuration and vulnerability analysis +AWS PrivateLink for DynamoDB Streams