AWS network-firewall documentation change
Summary
Updated documentation about firewall endpoint deployment, rule groups, firewall policies, and VPC endpoint associations. Added clarity on subnet protection limitations and component relationships.
Security assessment
Changes focus on structural clarifications (e.g., primary vs. additional firewall endpoints, component relationships) and link formatting. No explicit security vulnerabilities, mitigations, or new security features are introduced.
Diff
diff --git a/network-firewall/latest/developerguide/firewall-components.md b/network-firewall/latest/developerguide/firewall-components.md index 19a49152a..5747adf05 100644 --- a//network-firewall/latest/developerguide/firewall-components.md +++ b//network-firewall/latest/developerguide/firewall-components.md @@ -9 +9,3 @@ The AWS Network Firewall firewall runs stateless and stateful traffic inspection -You install the firewall endpoints on a per-Availability Zone basis in your VPC. For each Availability Zone where you want an endpoint, you choose a subnet to host it. The firewall endpoint can protect any subnet in your VPC except for the one in which it's located. +You install the firewall endpoints on a per-Availability Zone basis in your VPC. For each Availability Zone where you want to use the firewall, you choose a subnet to host the primary firewall endpoint. As needed, you can create VPC endpoint associations to provide additional subnets as firewall endpoints. + +A firewall endpoint can protect any subnet in your VPC except for the one in which it's located. @@ -13 +15,3 @@ You manage Network Firewall firewalls with the following central components. - * **Rule group** – Holds a reusable collection of criteria for inspecting traffic and for handling packets and traffic flows that match the inspection criteria. For example, you can choose to drop or pass a packet or all packets in a traffic flow based on the inspection criteria. Some rule groups fully define the behavior and some use lower-level rules that provide more detail. Rule groups are either stateless or stateful. For more information about rule groups and rules, see [Rule groups in AWS Network Firewall](./rule-groups.html). + * **Rule group** – Holds a reusable collection of criteria for inspecting traffic and for handling packets and traffic flows that match the inspection criteria. For example, you can choose to drop or pass a packet or all packets in a traffic flow based on the inspection criteria. Some rule groups fully define the behavior and some use lower-level rules that provide more detail. Rule groups are either stateless or stateful. For more information about rule groups and rules, see [Rule groups](./rule-groups.html). + + * **Firewall policy** – Defines a reusable set of stateless and stateful rule groups, along with some policy-level behavior settings. The firewall policy provides the network traffic filtering behavior for a firewall. You can use a single firewall policy in multiple firewalls. For more information about firewall policies, see [Firewall policies](./firewall-policies.html). @@ -15 +19 @@ You manage Network Firewall firewalls with the following central components. - * **Firewall policy** – Defines a reusable set of stateless and stateful rule groups, along with some policy-level behavior settings. The firewall policy provides the network traffic filtering behavior for a firewall. You can use a single firewall policy in multiple firewalls. For more information about firewall policies, see [Firewall policies in AWS Network Firewall](./firewall-policies.html). + * **Firewall** – Connects the inspection rules in the firewall policy to the primary VPC that the rules protect. Each firewall requires one firewall policy. The firewall additionally defines settings like how to log information about your network traffic and the firewall's stateful traffic filtering. For more information about firewalls, see [Firewalls and firewall endpoints](./firewalls.html). @@ -17 +21 @@ You manage Network Firewall firewalls with the following central components. - * **Firewall** – Connects the inspection rules in the firewall policy to the VPC that the rules protect. Each firewall requires one firewall policy. The firewall additionally defines settings like how to log information about your network traffic and the firewall's stateful traffic filtering. For more information about firewalls, see [Firewalls in AWS Network Firewall](./firewalls.html). + * **VPC endpoint association** – Implements a firewall's protections in additional firewall endpoints. For more information, see [Firewalls and firewall endpoints](./firewalls.html).