AWS lambda medium security documentation change
Summary
Updated networking requirements for MSK clusters in public subnets to mandate AWS PrivateLink endpoints for secure connections
Security assessment
The change explicitly requires AWS PrivateLink for public subnet MSK clusters where previously none were required. This addresses potential security risks from insecure public internet exposure by enforcing private connectivity, as evidenced by the replacement of 'None' with PrivateLink requirements in the configuration table.
Diff
diff --git a/lambda/latest/dg/with-msk-cluster-network.md b/lambda/latest/dg/with-msk-cluster-network.md index 85d2d513a..8346811b1 100644 --- a//lambda/latest/dg/with-msk-cluster-network.md +++ b//lambda/latest/dg/with-msk-cluster-network.md @@ -54 +54 @@ A NAT gateway allows resources in your private subnet to access the public inter -So far, we’ve assumed that your MSK cluster resides in a private subnet within your VPC, which is the more common case. If your MSK cluster is in a public subnet within your VPC, it already has access to the internet, and you don’t need any additional networking components to invoke your function. The following table summarizes the networking configuration requirements based on how you configure your MSK cluster and Lambda event source mapping: +So far, we’ve assumed that your MSK cluster resides in a private subnet within your VPC, which is the more common case. However, even if your MSK cluster is in a public subnet within your VPC, you must configure AWS PrivateLink endpoints to enable a secure connection. The following table summarizes the networking configuration requirements based on how you configure your MSK cluster and Lambda event source mapping: @@ -59 +59 @@ Private subnet | On-demand mode | NAT gateway (in your VPC's public subnet), o -Public subnet | On-demand mode | None +Public subnet | On-demand mode | AWS PrivateLink endpoints (in your VPC's public subnet) to enable access to Lambda, AWS STS, and optionally, Secrets Manager. @@ -136 +136 @@ You can configure AWS PrivateLink endpoints to poll messages from your cluster, -Configuring PrivateLink endpoints is required only if your event source mapping uses on-demand mode, and your cluster resides within a private subnet of your VPC. If your cluster resides in a public subnet of your VPC, or your event source mapping uses provisioned mode, Lambda establishes the required connections for you. +Configuring PrivateLink endpoints is required only if your event source mapping uses on-demand mode. If your event source mapping uses provisioned mode, Lambda establishes the required connections for you.