AWS vpc documentation change
Summary
Added clarification that CloudFormation template deployment is optional and doesn't enable VPC BPA by default
Security assessment
Emphasizes that security feature (VPC BPA) must be explicitly enabled separately from infrastructure deployment, improving security posture awareness
Diff
diff --git a/vpc/latest/userguide/security-vpc-bpa-example.md b/vpc/latest/userguide/security-vpc-bpa-example.md index d6b380212..7a394bee1 100644 --- a//vpc/latest/userguide/security-vpc-bpa-example.md +++ b//vpc/latest/userguide/security-vpc-bpa-example.md @@ -5 +5 @@ -Deploy CloudFormation templateView the impact of VPC BPA with Network Access AnalyzerScenario 1 - Connect to instances without BPA turned onScenario 2 - Turn on BPAScenario 3 - Modify BPA modeScenario 4 - Create an exclusionScenario 5 - Modify exclusion modeScenario 6 - Modify BPA modeCleanup +Deploy CloudFormation template (optional)View the impact of VPC BPA with Network Access AnalyzerScenario 1 - Connect to instances without VPC BPA turned onScenario 2 - Turn on VPC BPA in Bidirectional modeScenario 3 - Change VPC BPA to Ingress-only modeScenario 4 - Create an exclusionScenario 5 - Modify exclusion modeScenario 6 - Modify VPC BPA modeCleanup @@ -21 +21 @@ To fully understand the VPC BPA feature, you'll need certain resources in your a - * Deploy CloudFormation template + * Deploy CloudFormation template (optional) @@ -25 +25 @@ To fully understand the VPC BPA feature, you'll need certain resources in your a - * Scenario 1 - Connect to instances without BPA turned on + * Scenario 1 - Connect to instances without VPC BPA turned on @@ -27 +27 @@ To fully understand the VPC BPA feature, you'll need certain resources in your a - * Scenario 2 - Turn on BPA + * Scenario 2 - Turn on VPC BPA in Bidirectional mode @@ -29 +29 @@ To fully understand the VPC BPA feature, you'll need certain resources in your a - * Scenario 3 - Modify BPA mode + * Scenario 3 - Change VPC BPA to Ingress-only mode @@ -35 +35 @@ To fully understand the VPC BPA feature, you'll need certain resources in your a - * Scenario 6 - Modify BPA mode + * Scenario 6 - Modify VPC BPA mode @@ -42 +42 @@ To fully understand the VPC BPA feature, you'll need certain resources in your a -## Deploy CloudFormation template +## Deploy CloudFormation template (optional) @@ -44 +44 @@ To fully understand the VPC BPA feature, you'll need certain resources in your a -To demonstrate how this feature works, you need a VPC, subnets, instances, and other resources. To make it easier to complete this demonstration, we’ve provided an AWS CloudFormation template below that you can use to quickly spin up the resources required for the scenarios in this demo. +To demonstrate how this feature works, you need a VPC, subnets, instances, and other resources. To make it easier to complete this demonstration, we’ve provided an AWS CloudFormation template below that you can use to quickly spin up the resources required for the scenarios in this demo. This step is optional and you may want to just view the diagrams in the Scenarios in this section. @@ -48 +48,6 @@ To demonstrate how this feature works, you need a VPC, subnets, instances, and o -There are costs associated with the resources you create in this section with the CloudFormation template, such as the cost of the NAT gateway and public IPv4 addresses. To avoid excess costs, ensure that you complete the Cleanup steps to remove all resources created for the purpose of this example. + * There are costs associated with the resources you create in this section with the CloudFormation template, such as the cost of the NAT gateway and public IPv4 addresses. To avoid excess costs, ensure that you complete the Cleanup steps to remove all resources created for the purpose of this example. + + * This CloudFormation template creates the underlying resources needed for VPC BPA but does not enable the VPC BPA feature itself. The resources deployed here are intended to help you understand and test VPC BPA functionality once you choose to enable it separately. + + + @@ -487 +492 @@ AWS Management Console - 10. View the findings of the analysis. Each row under **Findings** shows a network path that a packet can take in a network to or from an internet gateway in your account. In this case, if you turn on VPC BPA and none of the VPCs and or subnets that appear in these findings are configured as BPA exclusions, traffic to those VPCs and subnets will be restricted. + 10. View the findings of the analysis. Each row under **Findings** shows a network path that a packet can take in a network to or from an internet gateway in your account. In this case, if you turn on VPC BPA and none of the VPCs and or subnets that appear in these findings are configured as VPC BPA exclusions, traffic to those VPCs and subnets will be restricted. @@ -489 +494 @@ AWS Management Console - 11. Analyze each finding to understand the impact of BPA on resources in your VPCs. + 11. Analyze each finding to understand the impact of VPC BPA on resources in your VPCs. @@ -694 +699 @@ The results show the traffic to and from the internet gateways in all the VPCs i - 4. Analyze the findings to understand the impact of BPA on resources in your VPCs. + 4. Analyze the findings to understand the impact of VPC BPA on resources in your VPCs. @@ -701 +706 @@ The impact analysis is complete. -## Scenario 1 - Connect to instances without BPA turned on +## Scenario 1 - Connect to instances without VPC BPA turned on @@ -703 +708 @@ The impact analysis is complete. -In this section, to set a baseline and ensure that, before you enable BPA, all instances can be reached, you'll connect to all instances and ping a public IP address. +In this section, EC2 instances in public subnets A and B are reachable from the internet via the Internet Gateway, which allows both inbound and outbound traffic. Instances C and D in the private subnet can initiate outbound traffic through the NAT Gateway or Egress-Only Internet Gateway, but are not directly reachable from the internet. This setup provides internet access to some resources while protecting others. The purpose of this setup is to set a baseline and ensure that, before you enable VPC BPA, all instances can be reached, you'll connect to all instances and ping a public IP address. @@ -707 +712 @@ Diagram of a VPC without VPC BPA turned on: - + @@ -862 +867 @@ Note that the ping is successful and traffic is not blocked. -## Scenario 2 - Turn on BPA +## Scenario 2 - Turn on VPC BPA in Bidirectional mode @@ -866 +871 @@ In this section you'll turn on VPC BPA and block traffic to and from the interne -Diagram of VPC BPA Bidirectional mode turned on: +Diagram showing VPC BPA Bidirectional mode turned on: @@ -868 +873 @@ Diagram of VPC BPA Bidirectional mode turned on: - + @@ -870 +875 @@ Diagram of VPC BPA Bidirectional mode turned on: -### 2.1 Enable VPC BPA block bidirectional mode +### 2.1 Enable VPC BPA bidirectional mode @@ -872 +877 @@ Diagram of VPC BPA Bidirectional mode turned on: -Complete this section to enable VPC BPA. +Complete this section to enable VPC BPA. VPC BPA bidirectional mode blocks all traffic to and from internet gateways and egress-only internet gateways in this Region (except for excluded VPCs and subnets). @@ -885 +890 @@ AWS Management Console - 5. Wait for the **Status** to change to **On**. It may take a few minutes for BPA settings to take effect and the status to be updated. + 5. Wait for the **Status** to change to **On**. It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -899 +904 @@ AWS CLI -It may take a few minutes for BPA settings to take effect and the status to be updated. +It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -1095 +1100 @@ AWS CLI -## Scenario 3 - Modify BPA mode +Note that you can also [Monitor VPC BPA impact with flow logs](./security-vpc-bpa-assess-impact-main.html#security-vpc-bpa-fl). @@ -1097 +1102,3 @@ AWS CLI -In this section you'll change the VPC BPA traffic direction and allow only traffic that uses a NAT gateway or egress-only internet gateway. +## Scenario 3 - Change VPC BPA to Ingress-only mode + +In this section you'll change the VPC BPA traffic direction and allow only traffic that uses a NAT gateway or egress-only internet gateway. EC2 instances A and B in the public subnets will be unreachable from the internet because BPA blocks inbound traffic through the Internet Gateway. Instances C and D in the private subnet will remain able to initiate outbound traffic via the NAT gateway and Egress-Only Internet Gateway, and therefore can still reach the internet. @@ -1101 +1108 @@ Diagram of VPC BPA Ingress-only mode turned on: - + @@ -1118 +1125 @@ AWS Management Console - 5. Save the changes and wait for the status to be updated. It may take a few minutes for BPA settings to take effect and the status to be updated. + 5. Save the changes and wait for the status to be updated. It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -1130 +1137 @@ AWS CLI -It may take a few minutes for BPA settings to take effect and the status to be updated. +It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -1286 +1293 @@ Note that the ping is successful and traffic is not blocked. -In this section you'll create an exclusion and only block traffic to and from the subnet that is not excluded from VPC BPA. A VPC BPA exclusion is a mode that can be applied to a single VPC or subnet that exempts it from the account’s BPA mode and will allow bidirectional or egress-only access. You can create BPA exclusions for VPCs and subnets even when BPA is not enabled on the account to ensure that there is no traffic disruption to the exclusions when VPC BPA is turned on. +In this section, you'll create an exclusion. VPC BPA will then only block traffic on the subnets _without_ an exclusion. A VPC BPA exclusion is a mode that can be applied to a single VPC or subnet that exempts it from the account’s VPC BPA mode and will allow bidirectional or egress-only access. You can create VPC BPA exclusions for VPCs and subnets even when VPC BPA is not enabled on the account to ensure that there is no traffic disruption to the exclusions when VPC BPA is turned on. @@ -1292 +1299 @@ Diagram of VPC BPA Ingress-only mode turned on and Subnet A exclusion with Bidir - + @@ -1296 +1303 @@ Diagram of VPC BPA Ingress-only mode turned on and Subnet A exclusion with Bidir -Complete this section to create an exclusion. A VPC BPA exclusion is a mode that can be applied to a single VPC or subnet that exempts it from the account’s BPA mode and will allow bidirectional or egress-only access. You can create BPA exclusions for VPCs and subnets even when BPA is not enabled on the account to ensure that there is no traffic disruption to the exclusions when VPC BPA is turned on. +Complete this section to create an exclusion. A VPC BPA exclusion is a mode that can be applied to a single VPC or subnet that exempts it from the account’s VPC BPA mode and will allow bidirectional or egress-only access. You can create VPC BPA exclusions for VPCs and subnets even when VPC BPA is not enabled on the account to ensure that there is no traffic disruption to the exclusions when VPC BPA is turned on. @@ -1510 +1517,5 @@ AWS CLI -In this section you'll change the allow traffic direction on the exclusion to see how it impacts VPC BPA. Note that the egress-only mode for an exclusion isn't really meaningful with VPC BPA enabled in block ingress-only mode. This is the same behavior as Scenario 3. +In this section you'll change the allow traffic direction on the exclusion to see how it impacts VPC BPA. + +###### Note + +In this scenario, you'll change the exclusion mode to Egress-only. Note that when you do this, the Egress-only exclusion on Subnet A doesn't allow outbound traffic, which is counterintuitive because you’d expect it to permit outbound traffic. However, since the account-level BPA is Ingress-only, Egress-only exclusions are ignored, and Subnet A’s routing to an internet gateway is restricted by VPC BPA, blocking outbound traffic. To enable outbound traffic on Subnet A, you'd have to switch VPC BPA to Bidirectional mode. @@ -1514 +1525 @@ Diagram of VPC BPA Ingress-only mode turned on and Subnet A exclusion with egres - + @@ -1527 +1538 @@ AWS Management Console - 3. Wait for the **Exclusion** status to change to **Active**. It may take a few minutes for BPA settings to take effect and the status to be updated. You may need to refresh the exclusion table to see the change. + 3. Wait for the **Exclusion** status to change to **Active**. It may take a few minutes for VPC BPA settings to take effect and the status to be updated. You may need to refresh the exclusion table to see the change. @@ -1539 +1550 @@ AWS CLI -It may take a few minutes for BPA settings to take effect and the status to be updated. +It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -1684 +1695 @@ Note that the ping is successful and traffic is not blocked. -## Scenario 6 - Modify BPA mode +## Scenario 6 - Modify VPC BPA mode @@ -1690 +1701 @@ Diagram of VPC BPA Bidirectional mode turned on and Subnet A exclusion with egre - + @@ -1694 +1705 @@ Diagram of VPC BPA Bidirectional mode turned on and Subnet A exclusion with egre -Complete this section to change the BPA mode. +Complete this section to change the VPC BPA mode. @@ -1707 +1718 @@ AWS Management Console - 5. Wait for the **Status** to change to **On**. It may take a few minutes for BPA settings to take effect and the status to be updated. + 5. Wait for the **Status** to change to **On**. It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -1719 +1730 @@ AWS CLI -It may take a few minutes for BPA settings to take effect and the status to be updated. +It may take a few minutes for VPC BPA settings to take effect and the status to be updated. @@ -1921 +1932 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Assess impact of BPA and monitor BPA +Assess impact of VPC BPA and monitor VPC BPA