AWS lambda medium security documentation change
Summary
Expanded PrivateLink requirement to all on-demand mode configurations regardless of subnet type
Security assessment
Removed the exception for public subnets in PrivateLink requirements, ensuring secure connections are enforced in all on-demand mode scenarios. This closes a potential security gap where public subnet configurations might have lacked encryption.
Diff
diff --git a/lambda/latest/dg/with-msk-cluster-network.md b/lambda/latest/dg/with-msk-cluster-network.md index 85d2d513a..8346811b1 100644 --- a//lambda/latest/dg/with-msk-cluster-network.md +++ b//lambda/latest/dg/with-msk-cluster-network.md @@ -54 +54 @@ A NAT gateway allows resources in your private subnet to access the public inter -So far, we’ve assumed that your MSK cluster resides in a private subnet within your VPC, which is the more common case. If your MSK cluster is in a public subnet within your VPC, it already has access to the internet, and you don’t need any additional networking components to invoke your function. The following table summarizes the networking configuration requirements based on how you configure your MSK cluster and Lambda event source mapping: +So far, we’ve assumed that your MSK cluster resides in a private subnet within your VPC, which is the more common case. However, even if your MSK cluster is in a public subnet within your VPC, you must configure AWS PrivateLink endpoints to enable a secure connection. The following table summarizes the networking configuration requirements based on how you configure your MSK cluster and Lambda event source mapping: @@ -59 +59 @@ Private subnet | On-demand mode | NAT gateway (in your VPC's public subnet), o -Public subnet | On-demand mode | None +Public subnet | On-demand mode | AWS PrivateLink endpoints (in your VPC's public subnet) to enable access to Lambda, AWS STS, and optionally, Secrets Manager. @@ -136 +136 @@ You can configure AWS PrivateLink endpoints to poll messages from your cluster, -Configuring PrivateLink endpoints is required only if your event source mapping uses on-demand mode, and your cluster resides within a private subnet of your VPC. If your cluster resides in a public subnet of your VPC, or your event source mapping uses provisioned mode, Lambda establishes the required connections for you. +Configuring PrivateLink endpoints is required only if your event source mapping uses on-demand mode. If your event source mapping uses provisioned mode, Lambda establishes the required connections for you.