AWS vpc-lattice documentation change
Summary
Expanded client configuration guidance to include macOS and added VPC endpoint recommendation
Security assessment
Added security best practice recommendation to use VPC endpoints instead of static routes, improving secure connectivity guidance
Diff
diff --git a/vpc-lattice/latest/ug/security-groups.md b/vpc-lattice/latest/ug/security-groups.md index e89680c6c..766997ea1 100644 --- a//vpc-lattice/latest/ug/security-groups.md +++ b//vpc-lattice/latest/ug/security-groups.md @@ -41 +41 @@ For more information, see [AWS-managed prefix lists](https://docs.aws.amazon.com -###### Windows clients +###### Windows and macOS clients @@ -43 +43 @@ For more information, see [AWS-managed prefix lists](https://docs.aws.amazon.com -The addresses in the VPC Lattice prefix lists are link-local addresses and non-routable public addresses. If you connect to VPC Lattice from a Windows client, you must update the configuration of the Windows client so that it forwards the IP addresses in the managed prefix list to the primary IP address for the client. The following is an example command that updates the configuration of the Windows client, where 169.254.171.0 is one of the addresses in the managed prefix list. +The addresses in the VPC Lattice prefix lists are link-local addresses and non-routable public addresses. If you connect to VPC Lattice from these clients, you must update their configurations so that it forwards the IP addresses in the managed prefix list to the primary IP address for the client. The following is an example command that updates the configuration of the Windows client, where 169.254.171.0 is one of the addresses in the managed prefix list. @@ -47,0 +48,7 @@ The addresses in the VPC Lattice prefix lists are link-local addresses and non-r +The following is an example command that updates the configuration of the macOS client, where 169.254.171.0 is one of the addresses in the managed prefix list. + + + sudo route -n add -net 169.254.171.0 primary-ip-address 255.255.255.0 + +To avoid creating a static route, we recommend that you use a service network endpoint in a VPC to establish connectivity. For more information, see [Manage VPC endpoint associations](./service-network-associations.html#service-network-vpc-endpoint-associations). +