AWS AWSEC2 documentation change
Summary
Reorganized console instructions into unified workflow, added idle connection timeout configuration details, expanded CLI/PowerShell examples, and added considerations section
Security assessment
While the changes document security-related features like security group modification and source/destination checking, there's no evidence of addressing a specific vulnerability. The connection timeout documentation improves security posture guidance but doesn't indicate a patched issue.
Diff
diff --git a/AWSEC2/latest/UserGuide/modify-network-interface-attributes.md b/AWSEC2/latest/UserGuide/modify-network-interface-attributes.md index d83a8b9af..7c5c6fc6e 100644 --- a//AWSEC2/latest/UserGuide/modify-network-interface-attributes.md +++ b//AWSEC2/latest/UserGuide/modify-network-interface-attributes.md @@ -16,0 +17 @@ You can change the following network interface attributes: + * Idle connection tracking timeout @@ -20 +21,9 @@ You can change the following network interface attributes: -###### To change the description of a network interface using the console + +###### Considerations + +You can't change the attributes of a requester-managed network interface. + +Console + + +###### To modify network interface attributes @@ -28 +37 @@ You can change the following network interface attributes: - 4. Choose **Actions** , **Change description**. + 4. To change the description, do the following @@ -30 +39 @@ You can change the following network interface attributes: - 5. For **Description** , enter a description for the network interface. + 1. Choose **Actions** , **Change description**. @@ -32 +41 @@ You can change the following network interface attributes: - 6. Choose **Save**. + 2. For **Description** , enter a description. @@ -33,0 +43 @@ You can change the following network interface attributes: + 3. Choose **Save**. @@ -34,0 +45 @@ You can change the following network interface attributes: + 5. To change the security groups, do the following: @@ -35,0 +47 @@ You can change the following network interface attributes: + 1. Choose **Actions** , **Change security groups**. @@ -37 +49 @@ You can change the following network interface attributes: -###### To change the security groups of a network interface using the console + 2. For **Associated security groups** , add and remove security groups as needed. The security group and network interface must be created for the same VPC. @@ -39 +51 @@ You can change the following network interface attributes: - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + 3. Choose **Save**. @@ -41 +53 @@ You can change the following network interface attributes: - 2. In the navigation pane, choose **Network Interfaces**. + 6. To change the termination behavior, do the following: @@ -43 +55 @@ You can change the following network interface attributes: - 3. Select the checkbox for the network interface. + 1. Choose **Actions** , **Change termination behavior**. @@ -45 +57 @@ You can change the following network interface attributes: - 4. Choose **Actions** , **Change security groups**. + 2. Select or clear **Delete on termination** , **Enable**. @@ -47 +59 @@ You can change the following network interface attributes: - 5. For **Associated security groups** , select the security groups to use, and then choose **Save**. + 3. Choose **Save**. @@ -49 +61 @@ You can change the following network interface attributes: -The security group and network interface must be created for the same VPC. To change the security group for interfaces owned by other services, such as Elastic Load Balancing, do so through that service. + 7. To change source/destination checking, do the following: @@ -50,0 +63 @@ The security group and network interface must be created for the same VPC. To ch + 1. Choose **Actions** , **Change source/dest check**. @@ -51,0 +65 @@ The security group and network interface must be created for the same VPC. To ch + 2. Select or clear **Source/destination check** , **Enable**. @@ -52,0 +67 @@ The security group and network interface must be created for the same VPC. To ch + 3. Choose **Save**. @@ -54 +69 @@ The security group and network interface must be created for the same VPC. To ch -###### To change the termination behavior of a network interface using the console + 8. To change idle connection tracking timeouts, do the following: @@ -56 +71 @@ The security group and network interface must be created for the same VPC. To ch - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + 1. Choose **Actions** , **Modify idle connection tracking timeout**. @@ -58 +73 @@ The security group and network interface must be created for the same VPC. To ch - 2. In the navigation pane, choose **Network Interfaces**. + 2. Modify timeout values as needed. For more information, see [Idle connection tracking timeout](./security-group-connection-tracking.html#connection-tracking-timeouts). @@ -60 +75 @@ The security group and network interface must be created for the same VPC. To ch - 3. Select the checkbox for the network interface. + * **TCP established timeout** : Timeout (in seconds) for idle TCP connections in an established state. Min: 60 seconds. Max: 432000 seconds (5 days). Default: 432000 seconds. Recommended: Less than 432000 seconds. @@ -62 +77 @@ The security group and network interface must be created for the same VPC. To ch - 4. Choose **Actions** , **Change termination behavior**. + * **UDP timeout** : Timeout (in seconds) for idle UDP flows that have seen traffic only in a single direction or a single request-response transaction. Min: 30 seconds. Max: 60 seconds. Default: 30 seconds. @@ -64 +79 @@ The security group and network interface must be created for the same VPC. To ch - 5. Select or clear **Delete on termination** , **Enable** as needed, and then choose **Save**. + * **UDP stream timeout** : Timeout (in seconds) for idle UDP flows classified as streams which have seen more than one request-response transaction. Min: 60 seconds. Max: 180 seconds (3 minutes). Default: 180 seconds. @@ -65,0 +81 @@ The security group and network interface must be created for the same VPC. To ch + 3. Choose **Save**. @@ -69 +84,0 @@ The security group and network interface must be created for the same VPC. To ch -###### To change source/destination checking for a network interface using the console @@ -71 +86 @@ The security group and network interface must be created for the same VPC. To ch - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). +AWS CLI @@ -73 +87,0 @@ The security group and network interface must be created for the same VPC. To ch - 2. In the navigation pane, choose **Network Interfaces**. @@ -75 +89 @@ The security group and network interface must be created for the same VPC. To ch - 3. Select the checkbox for the network interface. +###### Example: To modify the description @@ -77 +91 @@ The security group and network interface must be created for the same VPC. To ch - 4. Choose **Actions** , **Change source/dest check**. +Use the following [modify-network-interface-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-network-interface-attribute.html) command. @@ -79 +92,0 @@ The security group and network interface must be created for the same VPC. To ch - 5. Select or clear **Source/destination check** , **Enable** as needed, and then choose **Save**. @@ -80,0 +94,3 @@ The security group and network interface must be created for the same VPC. To ch + aws ec2 modify-network-interface-attribute \ + --network-interface-id eni-1234567890abcdef0 \ + --description "my updated description" @@ -81,0 +98 @@ The security group and network interface must be created for the same VPC. To ch +###### Example: To modify the security groups @@ -82,0 +100 @@ The security group and network interface must be created for the same VPC. To ch +Use the following [modify-network-interface-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-network-interface-attribute.html) command. @@ -84 +101,0 @@ The security group and network interface must be created for the same VPC. To ch -###### To change idle connection tracking timeouts: @@ -86 +103,3 @@ The security group and network interface must be created for the same VPC. To ch - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + aws ec2 modify-network-interface-attribute \ + --network-interface-id eni-1234567890abcdef0 \ + --groups sg-1234567890abcdef0 @@ -88 +107 @@ The security group and network interface must be created for the same VPC. To ch - 2. In the navigation pane, choose **Network Interfaces**. +###### Example: To modify the termination behavior @@ -90 +109 @@ The security group and network interface must be created for the same VPC. To ch - 3. Select the checkbox for the network interface. +Use the following [modify-network-interface-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-network-interface-attribute.html) command. @@ -92 +110,0 @@ The security group and network interface must be created for the same VPC. To ch - 4. Choose **Actions** , **Modify connection timeout**. @@ -94 +112,3 @@ The security group and network interface must be created for the same VPC. To ch - 5. Modify the idle connection tracking timeouts. For more information about these options, see [Idle connection tracking timeout](./security-group-connection-tracking.html#connection-tracking-timeouts). + aws ec2 modify-network-interface-attribute \ + --network-interface-id eni-1234567890abcdef0 \ + --attachment AttachmentId=eni-attach-43348162abEXAMPLE,DeleteOnTermination=false @@ -96 +116 @@ The security group and network interface must be created for the same VPC. To ch - * **TCP established timeout** : Timeout (in seconds) for idle TCP connections in an established state. Min: 60 seconds. Max: 432000 seconds (5 days). Default: 432000 seconds. Recommended: Less than 432000 seconds. +###### Example: To enable source/destination checking @@ -98 +118 @@ The security group and network interface must be created for the same VPC. To ch - * **UDP timeout** : Timeout (in seconds) for idle UDP flows that have seen traffic only in a single direction or a single request-response transaction. Min: 30 seconds. Max: 60 seconds. Default: 30 seconds. +Use the following [modify-network-interface-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-network-interface-attribute.html) command. @@ -100 +119,0 @@ The security group and network interface must be created for the same VPC. To ch - * **UDP stream timeout** : Timeout (in seconds) for idle UDP flows classified as streams which have seen more than one request-response transaction. Min: 60 seconds. Max: 180 seconds (3 minutes). Default: 180 seconds. @@ -102 +121,37 @@ The security group and network interface must be created for the same VPC. To ch - 6. Choose **Save**. + aws ec2 modify-network-interface-attribute \ + --network-interface-id eni-1234567890abcdef0 \ + --source-dest-check + +###### Example: To modify idle connection tracking timout + +Use the following [modify-network-interface-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-network-interface-attribute.html) command. For more information, see [Idle connection tracking timeout](./security-group-connection-tracking.html#connection-tracking-timeouts). + + + aws ec2 modify-network-interface-attribute \ + --network-interface-id eni-1234567890abcdef0 \ + --connection-tracking-specification TcpEstablishedTimeout=172800,UdpStreamTimeout=90,UdpTimeout=60 + +PowerShell + + +###### Example: To modify the description + +Use the following [Edit-EC2NetworkInterfaceAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2NetworkInterfaceAttribute.html) cmdlet. + + + Edit-EC2NetworkInterfaceAttribute ` + -NetworkInterfaceId eni-1234567890abcdef0 ` + -Description "my updated description" + +###### Example: To modify the security groups + +Use the following [Edit-EC2NetworkInterfaceAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2NetworkInterfaceAttribute.html) cmdlet. + + + Edit-EC2NetworkInterfaceAttribute ` + -NetworkInterfaceId eni-1234567890abcdef0 ` + -Group sg-1234567890abcdef0 + +###### Example: To modify the termination behavior + +Use the following [Edit-EC2NetworkInterfaceAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2NetworkInterfaceAttribute.html) cmdlet. @@ -104,0 +160,4 @@ The security group and network interface must be created for the same VPC. To ch + Edit-EC2NetworkInterfaceAttribute ` + -NetworkInterfaceId eni-1234567890abcdef0 ` + -Attachment_AttachmentId eni-attach-43348162abEXAMPLE ` + -Attachment_DeleteOnTermination $false @@ -105,0 +165 @@ The security group and network interface must be created for the same VPC. To ch +###### Example: To enable source/destination checking @@ -107 +167 @@ The security group and network interface must be created for the same VPC. To ch -###### To modify network interface attributes using the command line +Use the following [Edit-EC2NetworkInterfaceAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2NetworkInterfaceAttribute.html) cmdlet. @@ -109 +168,0 @@ The security group and network interface must be created for the same VPC. To ch -You can use one of the following commands. For more information about these command line interfaces, see [Access Amazon EC2](./concepts.html#access-ec2). @@ -111 +170,3 @@ You can use one of the following commands. For more information about these comm - * [modify-network-interface-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-network-interface-attribute.html) (AWS CLI) + Edit-EC2NetworkInterfaceAttribute ` + -NetworkInterfaceId eni-1234567890abcdef0 ` + -SourceDestCheck $true @@ -113 +174 @@ You can use one of the following commands. For more information about these comm - * [Edit-EC2NetworkInterfaceAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2NetworkInterfaceAttribute.html) (AWS Tools for Windows PowerShell) +###### Example: To modify idle connection tracking timeouts @@ -114,0 +176 @@ You can use one of the following commands. For more information about these comm +Use the following [Edit-EC2NetworkInterfaceAttribute](https://docs.aws.amazon.com/powershell/latest/reference/items/Edit-EC2NetworkInterfaceAttribute.html) cmdlet. For more information, see [Idle connection tracking timeout](./security-group-connection-tracking.html#connection-tracking-timeouts). @@ -116,0 +179,5 @@ You can use one of the following commands. For more information about these comm + Edit-EC2NetworkInterfaceAttribute ` + -NetworkInterfaceId eni-1234567890abcdef0 ` + -ConnectionTrackingSpecification_TcpEstablishedTimeout 172800 ` + -ConnectionTrackingSpecification_UdpStreamTimeout 90 ` + -ConnectionTrackingSpecification_UdpTimeout 60