AWS vpc documentation change
Summary
Updated documentation to consistently use 'VPC BPA' terminology instead of 'BPA' throughout the file, including section headers, limitations, and operational guidance. Added clarification about security appliance routing requirements and service communication implications.
Security assessment
Changes primarily involve branding/terminology consistency (adding 'VPC' prefix to BPA references) rather than addressing security vulnerabilities. The update about 3rd-party security appliances in subnets clarifies existing security controls but doesn't introduce new security features or address specific vulnerabilities. Mention of potential information exposure through services like DNS Resolver was already present and only received terminology updates.
Diff
diff --git a/vpc/latest/userguide/security-vpc-bpa-basics.md b/vpc/latest/userguide/security-vpc-bpa-basics.md index 05bbc3784..8726d7e56 100644 --- a//vpc/latest/userguide/security-vpc-bpa-basics.md +++ b//vpc/latest/userguide/security-vpc-bpa-basics.md @@ -5 +5 @@ -Regional availabilityAWS service impact and supportBPA limitationsControl access to VPC BPA with an IAM policyEnable BPA bidirectional mode for your accountChange VPC BPA mode to ingress-onlyCreate and delete exclusionsEnable VPC BPA at the Organization level +Regional availabilityAWS service impact and supportVPC BPA limitationsControl access to VPC BPA with an IAM policyEnable VPC BPA bidirectional mode for your accountChange VPC BPA mode to ingress-onlyCreate and delete exclusionsEnable VPC BPA at the Organization level @@ -7 +7 @@ Regional availabilityAWS service impact and supportBPA limitationsControl access -# BPA basics +# VPC BPA basics @@ -17 +17 @@ This section covers important details about VPC BPA, including which services su - * BPA limitations + * VPC BPA limitations @@ -21 +21 @@ This section covers important details about VPC BPA, including which services su - * Enable BPA bidirectional mode for your account + * Enable VPC BPA bidirectional mode for your account @@ -84 +84 @@ Traffic related to private connectivity, such as traffic for the following servi - * If you are routing incoming and outgoing traffic through an appliance (such as a 3rd-party security or monitoring tool) running on an EC2 instance in a subnet, when using BPA, that subnet needs to be an exclusion for traffic to flow in and out of it. Other subnets sending traffic to the appliance subnet and not to the internet gateway do not need to be added as exclusions. + * If you are routing incoming and outgoing traffic through an appliance (such as a 3rd-party security or monitoring tool) running on an EC2 instance in a subnet, when using VPC BPA, that subnet needs to be an exclusion for traffic to flow in and out of it. Other subnets sending traffic to the appliance subnet and not to the internet gateway do not need to be added as exclusions. @@ -86 +86 @@ Traffic related to private connectivity, such as traffic for the following servi - * Traffic sent privately from resources in your VPC to other services running in your VPC, such as the EC2 DNS Resolver or Amazon OpenSearch Service, is allowed even when BPA is turned on because it does not pass through an internet gateway in your VPC. It is possible that these services may make requests to resources outside of the VPC on your behalf, for example, in order to resolve a DNS query, and may expose information about the activity of resources within your VPC if not mitigated through other security controls. + * Traffic sent privately from resources in your VPC to other services running in your VPC, such as the EC2 DNS Resolver or Amazon OpenSearch Service, is allowed even when VPC BPA is turned on because it does not pass through an internet gateway in your VPC. It is possible that these services may make requests to resources outside of the VPC on your behalf, for example, in order to resolve a DNS query, and may expose information about the activity of resources within your VPC if not mitigated through other security controls. @@ -91 +91 @@ Traffic related to private connectivity, such as traffic for the following servi -## BPA limitations +## VPC BPA limitations @@ -99 +99 @@ For examples of IAM policies that allow/deny access to the VPC BPA feature, see -## Enable BPA bidirectional mode for your account +## Enable VPC BPA bidirectional mode for your account @@ -127 +127 @@ AWS Management Console - 5. Wait for the **Status** to change to **On**. It may take a few minutes for BPA settings to take effect and the status to be updated. + 5. Wait for the **Status** to change to **On**. It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -141 +141 @@ AWS CLI -It may take a few minutes for BPA settings to take effect and the status to be updated. +It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -165 +165 @@ AWS Management Console - 5. Save the changes and wait for the status to be updated. It may take a few minutes for BPA settings to take effect and the status to be updated. + 5. Save the changes and wait for the status to be updated. It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -177 +177 @@ AWS CLI -It may take a few minutes for BPA settings to take effect and the status to be updated. +It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -188 +188 @@ It may take a few minutes for BPA settings to take effect and the status to be u -A VPC BPA exclusion is a mode that can be applied to a single VPC or subnet that exempts it from the account’s BPA mode and will allow bidirectional or egress-only access. You can create BPA exclusions for VPCs and subnets even when BPA is not enabled on the account to ensure that there is no traffic disruption to the exclusions when VPC BPA is turned on. An exclusion for a VPC automatically applies to all subnets in the VPC. +A VPC BPA exclusion is a mode that can be applied to a single VPC or subnet that exempts it from the account’s VPC BPA mode and will allow bidirectional or egress-only access. You can create VPC BPA exclusions for VPCs and subnets even when VPC BPA is not enabled on the account to ensure that there is no traffic disruption to the exclusions when VPC BPA is turned on. An exclusion for a VPC automatically applies to all subnets in the VPC. @@ -209 +209 @@ AWS Management Console - * **Egress-only** : Allows outbound internet traffic from the excluded VPCs and subnets. Blocks inbound internet traffic to the excluded VPCs and subnets. This setting applies when BPA is set to **Bidirectional**. + * **Egress-only** : Allows outbound internet traffic from the excluded VPCs and subnets. Blocks inbound internet traffic to the excluded VPCs and subnets. This setting applies when VPC BPA is set to **Bidirectional**. @@ -257 +257 @@ Block public access to VPCs and subnets -Assess impact of BPA and monitor BPA +Assess impact of VPC BPA and monitor VPC BPA