AWS AWSEC2 medium security documentation change
Summary
Updated prerequisites for EC2 Fast Launch to require IAM policy attachment and auto-create CloudFormation resources. Added details about VPC, subnets, IMDSv2-enforced launch template, and restrictive security group.
Security assessment
The change enforces IMDSv2 (security hardening against SSRF vulnerabilities) and creates a security group with no rules (restrictive by default). The requirement to attach EC2FastLaunchFullAccess IAM policy ensures proper permissions. These are explicit security controls.
Diff
diff --git a/AWSEC2/latest/UserGuide/win-start-fast-launch-prereqs.md b/AWSEC2/latest/UserGuide/win-start-fast-launch-prereqs.md index 0dbf1a6ba..16976b7ee 100644 --- a//AWSEC2/latest/UserGuide/win-start-fast-launch-prereqs.md +++ b//AWSEC2/latest/UserGuide/win-start-fast-launch-prereqs.md @@ -9 +9 @@ Before you set up EC2 Fast Launch, verify that you've met the following prerequi - * If you don't use a launch template to configure your settings, ensure that a default VPC is configured for the Region in which you use EC2 Fast Launch. + * If you provide a custom launch template when you configure EC2 Fast Launch, the service uses the VPC and other configuration settings that you've defined in the launch template. For more information, see [Use a launch template when you set up EC2 Fast Launch](./win-fast-launch-configure.html#win-fast-launch-with-template). @@ -11 +11 @@ Before you set up EC2 Fast Launch, verify that you've met the following prerequi -If you accidentally delete your default VPC in the Region where you plan to configure EC2 Fast Launch, you can create a new default VPC in that Region. To learn more, see [Create a default VPC](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html#create-default-vpc) in the _Amazon VPC User Guide_. + * If you don't use a custom launch template to configure your settings, you must attach the [EC2FastLaunchFullAccess](./security-iam-awsmanpol.html#security-iam-awsmanpol-EC2FastLaunchFullAccess) policy to your current IAM role before you enable EC2 Fast Launch. Then the service automatically creates an AWS CloudFormation stack with the following resources in your AWS account. @@ -13 +13 @@ If you accidentally delete your default VPC in the Region where you plan to conf - * To specify a non-default VPC, you must use a launch template when you configure Windows fast launch. For more information, see [Use a launch template when you set up EC2 Fast Launch](./win-fast-launch-configure.html#win-fast-launch-with-template). + * A virtual private cloud (VPC) @@ -15 +15,5 @@ If you accidentally delete your default VPC in the Region where you plan to conf - * If your account includes a policy that enforces IMDSv2 for Amazon EC2 instances, you must create a launch template that specifies the metadata configuration to enforce IMDSv2. + * Private subnets across multiple Availability Zones + + * A launch template configured with Instance Metadata Service Version 2 (IMDSv2) + + * A security group with no inbound or outbound rules