AWS vpc documentation change
Summary
Updated example resource IDs, added FilterInArns/FilterOutArns fields, simplified network path analysis output structure, added StatusMessage, and included new tagging examples
Security assessment
Changes primarily update example configurations and output formatting for Reachability Analyzer. While the documentation references security group misconfigurations (ENI_SG_RULES_MISMATCH), this is part of existing troubleshooting guidance rather than addressing a new security vulnerability. The added security group rule details and tagging examples demonstrate security best practices but do not introduce new security features.
Diff
diff --git a/vpc/latest/reachability/getting-started-cli.md b/vpc/latest/reachability/getting-started-cli.md index dad38579b..435b83ddb 100644 --- a//vpc/latest/reachability/getting-started-cli.md +++ b//vpc/latest/reachability/getting-started-cli.md @@ -85 +85 @@ Use the following [start-network-insights-analysis](https://awscli.amazonaws.com - aws ec2 start-network-insights-analysis --network-insights-path-id nip-0b26f224f1d131fa8 + aws ec2 start-network-insights-analysis --network-insights-path-id nip-0abc123def456789 @@ -92 +92 @@ The following is example output. - "NetworkInsightsAnalysisId": "nia-02207aa13eb480c7a", + "NetworkInsightsAnalysisId": "nia-0abc123def456789", @@ -94 +94 @@ The following is example output. - "NetworkInsightsPathId": "nip-0b26f224f1d131fa8", + "NetworkInsightsPathId": "nip-0abc123def456789", @@ -105 +105 @@ After the path analysis completes, you can view the results using the [describe- - aws ec2 describe-network-insights-analyses --network-insights-analysis-ids nia-02207aa13eb480c7a + aws ec2 describe-network-insights-analyses --network-insights-analysis-ids nia-0abc123def456789 @@ -109 +109 @@ After the path analysis completes, you can view the results using the [describe- -The following is example output where the path is not reachable. When a path is not reachable, `NetworkPathFound` is `false` and `ExplanationCode` contains an explanation code. For descriptions of the explanation codes, see [Reachability Analyzer explanation codes](./explanation-codes.html). In this example, `ENI_SG_RULES_MISMATCH` indicates that the security group does not allow the traffic. After you add a rule to the security group to allow the traffic, you can reanalyze the same path and confirm that it is reachable. +The following is example output where the path is not reachable. When a path is not reachable, `NetworkPathFound` is `false` and `ExplanationCode` contains an explanation code. For descriptions of the explanation codes, see [Reachability Analyzer explanation codes](./explanation-codes.html). In this example, `ENI_SG_RULES_MISMATCH`, indicates that the security group does not allow the traffic. After you add a rule to the security group to allow the traffic, you can reanalyze the same path and confirm that it is reachable. @@ -115,4 +115,10 @@ The following is example output where the path is not reachable. When a path is - "NetworkInsightsAnalysisId": "nia-02207aa13eb480c7a", - "NetworkInsightsAnalysisArn": "arn:aws:ec2:us-east-1:123456789012:network-insights-analysis/nia-02207aa13eb480c7a", - "NetworkInsightsPathId": "nip-0b26f224f1d131fa8", - "StartDate": "2023-03-20T22:58:37.495Z", + "NetworkInsightsAnalysisId": "nia-0abc123def456789", + "NetworkInsightsAnalysisArn": "arn:aws:ec2:us-west-2:123456789012:network-insights-analysis/nia-0abc123def456789", + "NetworkInsightsPathId": "nip-0abc123def456789", + "FilterInArns": [ + "arn:aws:ec2:us-west-2:123456789012:vpc/vpc-0abc123def456789" + ], + "FilterOutArns": [ + "arn:aws:ec2:us-west-2:123456789012:internet-gateway/igw-0abc123def456789" + ], + "StartDate": "2025-03-15T14:30:00.000Z", @@ -119,0 +126 @@ The following is example output where the path is not reachable. When a path is + "StatusMessage": "Analysis completed successfully", @@ -125,26 +132,3 @@ The following is example output where the path is not reachable. When a path is - "Id": "igw-0797cccdc9d73b0e5", - "Arn": "arn:aws:ec2:us-east-1:123456789012:internet-gateway/igw-0797cccdc9d73b0e5" - }, - "OutboundHeader": { - "DestinationAddresses": [ - "10.0.4.120/32" - ] - }, - "InboundHeader": { - "DestinationAddresses": [ - "34.230.71.227/32" - ], - "DestinationPortRanges": [ - { - "From": 22, - "To": 22 - } - ], - "Protocol": "6", - "SourceAddresses": [ - "11.0.0.0/32" - ], - "SourcePortRanges": [ - { - "From": 0, - "To": 0 + "Id": "i-0abc123def456789", + "Arn": "arn:aws:ec2:us-west-2:123456789012:instance/i-0abc123def456789", + "Name": "Source Instance" @@ -152,8 +135,0 @@ The following is example output where the path is not reachable. When a path is - ] - }, - "Vpc": { - "Id": "vpc-f1663d98ad28331c7", - "Arn": "arn:aws:ec2:us-east-1:123456789012:vpc/vpc-f1663d98ad28331c7" - }, - "AdditionalDetails": [], - "Explanations": [] @@ -163,7 +138,0 @@ The following is example output where the path is not reachable. When a path is - "AclRule": { - "Cidr": "0.0.0.0/0", - "Egress": "false", - "Protocol": "all", - "RuleAction": "allow", - "RuleNumber": 100 - }, @@ -171,5 +140,4 @@ The following is example output where the path is not reachable. When a path is - "Id": "acl-04fbcfb79260f6c5b", - "Arn": "arn:aws:ec2:us-east-1:123456789012:network-acl/acl-04fbcfb79260f6c5b" - }, - "AdditionalDetails": [], - "Explanations": [] + "Id": "eni-0abc123def456789", + "Arn": "arn:aws:ec2:us-west-2:123456789012:network-interface/eni-0abc123def456789", + "Name": "Source ENI" + } @@ -179,4 +146,0 @@ The following is example output where the path is not reachable. When a path is - "AttachedTo": { - "Id": "i-0495d385ad28331c7", - "Arn": "arn:aws:ec2:us-east-1:123456789012:instance/i-0495d385ad28331c7" - }, @@ -184,12 +148,6 @@ The following is example output where the path is not reachable. When a path is - "Id": "eni-0a25edef15a6cc08c", - "Arn": "arn:aws:ec2:us-east-1:123456789012:network-interface/eni-0a25edef15a6cc08c" - }, - "Subnet": { - "Id": "subnet-004ff41eccb4d1194", - "Arn": "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-004ff41eccb4d1194" - }, - "Vpc": { - "Id": "vpc-f1663d98ad28331c7", - "Arn": "arn:aws:ec2:us-east-1:123456789012:vpc/vpc-f1663d98ad28331c7" - }, - "AdditionalDetails": [], + "Id": "subnet-0abc123def456789", + "Arn": "arn:aws:ec2:us-west-2:123456789012:subnet/subnet-0abc123def456789", + "Name": "Private Subnet" + } + } + ], @@ -201,2 +159,3 @@ The following is example output where the path is not reachable. When a path is - "Id": "eni-0a25edef15a6cc08c", - "Arn": "arn:aws:ec2:us-east-1:123456789012:network-interface/eni-0a25edef15a6cc08c" + "Id": "eni-0def456789abc0123", + "Arn": "arn:aws:ec2:us-west-2:123456789012:network-interface/eni-0def456789abc0123", + "Name": "Destination ENI" @@ -206,2 +165,8 @@ The following is example output where the path is not reachable. When a path is - "Id": "sg-02f0d35a850ba727f", - "Arn": "arn:aws:ec2:us-east-1:123456789012:security-group/sg-02f0d35a850ba727f" + "Id": "sg-0abc123def456789", + "Arn": "arn:aws:ec2:us-west-2:123456789012:security-group/sg-0abc123def456789", + "Name": "Source Security Group" + }, + { + "Id": "sg-0def456789abc0123", + "Arn": "arn:aws:ec2:us-west-2:123456789012:security-group/sg-0def456789abc0123", + "Name": "Destination Security Group" @@ -210,4 +174,0 @@ The following is example output where the path is not reachable. When a path is - "Subnet": { - "Id": "subnet-004ff41eccb4d1194", - "Arn": "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-004ff41eccb4d1194" - }, @@ -215,2 +176,3 @@ The following is example output where the path is not reachable. When a path is - "Id": "vpc-f1663d98ad28331c7", - "Arn": "arn:aws:ec2:us-east-1:123456789012:vpc/vpc-f1663d98ad28331c7" + "Id": "vpc-0abc123def456789", + "Arn": "arn:aws:ec2:us-west-2:123456789012:vpc/vpc-0abc123def456789", + "Name": "Main VPC" @@ -217,0 +180,3 @@ The following is example output where the path is not reachable. When a path is + "PacketField": "destination-port", + "Port": 443, + "Protocol": "tcp" @@ -219,2 +184,2 @@ The following is example output where the path is not reachable. When a path is - ] - }, + ], + "AlternatePathHints": [ @@ -222,8 +187,3 @@ The following is example output where the path is not reachable. When a path is - "SequenceNumber": 4, - "Component": { - "Id": "i-0495d385ad28331c7", - "Arn": "arn:aws:ec2:us-east-1:123456789012:instance/i-0495d385ad28331c7" - }, - "InboundHeader": { - "DestinationAddresses": [ - "10.0.4.120/32" + "ComponentId": "sg-0fff111222333444", + "ComponentArn": "arn:aws:ec2:us-west-2:123456789012:security-group/sg-0fff111222333444" + } @@ -231 +191 @@ The following is example output where the path is not reachable. When a path is - "DestinationPortRanges": [ + "Tags": [ @@ -233,2 +193,6 @@ The following is example output where the path is not reachable. When a path is - "From": 22, - "To": 22 + "Key": "Project", + "Value": "NetworkTroubleshooting" + }, + { + "Key": "Environment", + "Value": "Production" @@ -235,0 +200,8 @@ The following is example output where the path is not reachable. When a path is + ] + }, + { + "NetworkInsightsAnalysisId": "nia-0def456789abc0123", + "NetworkInsightsAnalysisArn": "arn:aws:ec2:us-west-2:123456789012:network-insights-analysis/nia-0def456789abc0123", + "NetworkInsightsPathId": "nip-0abc123def456789", + "FilterInArns": [ + "arn:aws:ec2:us-west-2:123456789012:vpc/vpc-0abc123def456789" @@ -237,3 +209,2 @@ The following is example output where the path is not reachable. When a path is - "Protocol": "6", - "SourceAddresses": [ - "11.0.0.0/32" + "FilterOutArns": [ + "arn:aws:ec2:us-west-2:123456789012:internet-gateway/igw-0abc123def456789" @@ -241 +212,5 @@ The following is example output where the path is not reachable. When a path is - "SourcePortRanges": [ + "StartDate": "2025-04-10T09:45:00.000Z", + "Status": "succeeded", + "StatusMessage": "Analysis completed successfully", + "NetworkPathFound": false, + "ForwardPathComponents": [