AWS govcloud-us documentation change
Summary
Expanded Route 53 capabilities in GovCloud (US) including public DNS support, alias target restrictions, DNSSEC key requirements, and removed features list
Security assessment
Added documentation about DNSSEC signing requiring customer-managed keys in GovCloud and DNS queries staying within FedRAMP boundary, which are security-related features but not addressing specific vulnerabilities
Diff
diff --git a/govcloud-us/latest/UserGuide/govcloud-r53.md b/govcloud-us/latest/UserGuide/govcloud-r53.md index ebdb0c6d7..ff784990a 100644 --- a//govcloud-us/latest/UserGuide/govcloud-r53.md +++ b//govcloud-us/latest/UserGuide/govcloud-r53.md @@ -9 +9 @@ How Amazon Route 53 differs for AWS GovCloud (US-West) RegionDocumentation for A -Route 53 is a highly available and scalable Domain Name System (DNS) web service. In the AWS GovCloud (US), you can use Route 53 private DNS and health checking. +Route 53 is a highly available and scalable Domain Name System (DNS) web service. In the AWS GovCloud (US), you can use Route 53 public and private DNS and health checking. @@ -13 +13 @@ Route 53 is a highly available and scalable Domain Name System (DNS) web service - * Route 53 public hosted zones are not available. +Public Hosted Zones @@ -15 +15 @@ Route 53 is a highly available and scalable Domain Name System (DNS) web service - * Geolocation and latency based routing are not available. + * DNS queries will be answered from within FedRAMP boundary. @@ -17 +17,13 @@ Route 53 is a highly available and scalable Domain Name System (DNS) web service - * DNS record types HTTPS, SSHFP, SVCB, and TLSA DNS are not available. + * When creating alias records, you can now choose alias targets in the AWS GovCloud (US) Regions, but you cannot choose alias targets in global AWS Regions. Currently, we support alias targets for API Gateway, Elastic Beanstalk, Application Load Balancer, Classic Load Balancer, Network Load Balancer, Amazon S3 website endpoint, and VPC endpoint. The other alias targets are not supported. + + * The customer managed key that you use with DNSSEC signing must be in AWS GovCloud (US-West). + + * The CloudWatch Logs log group for query logging must be in AWS GovCloud (US-West). + + * CloudWatch metrics like DNSQueries can be found in AWS GovCloud (US-West). + + * IP-based routing type is not available. + + * Traffic Flow features are not available. + + * DNS query checking tool on the console, and `TestDNSAnswer` API are not available. @@ -24 +36 @@ Private Hosted Zones - * You can create private hosted zones in the AWS GovCloud (US). In general, the functionality is the same as for private hosted zones in the global version of Route 53. However, you can create alias records only when the alias target is another record in the same hosted zone. To route traffic to another AWS resource, such as an ELB load balancer or an S3 bucket, you can use a CNAME record instead of an alias record unless you're creating a record at the zone apex. + * You can create private hosted zones in the AWS GovCloud (US). In general, the functionality is the same as for private hosted zones in the commercial version of Route 53.