AWS network-firewall medium security documentation change
Summary
Added explicit statement that only firewall owners (not VPC endpoint association owners) can perform flow operations. Updated terminology and links.
Security assessment
The addition of ownership restrictions for flow operations directly addresses access control by preventing unauthorized users (VPC endpoint association owners) from executing sensitive operations like flow capture/flush. This clarifies security boundaries and enforces the principle of least privilege.
Diff
diff --git a/network-firewall/latest/developerguide/firewall-flow-operations.md b/network-firewall/latest/developerguide/firewall-flow-operations.md index 813b330cc..0747dd1ae 100644 --- a//network-firewall/latest/developerguide/firewall-flow-operations.md +++ b//network-firewall/latest/developerguide/firewall-flow-operations.md @@ -11 +11 @@ This section describes how to use flow operations to perform actions in your fir -Flow operations are asynchronous actions that you execute within a firewall to track and manage traffic that's logged within the firewall's state table. You can run flow capture operations or flow flush operations. Flow capture operations collect information about active flows, and flow flush operations remove specified flows from the firewall. +Flow operations are asynchronous actions that you execute within a firewall that you own. To track and manage traffic that's logged within the firewall's state table. You can run flow capture operations or flow flush operations. Flow capture operations collect information about active flows, and flow flush operations remove specified flows from the firewall. @@ -52,0 +53,2 @@ Before using flow operations, consider the following: + * Only firewall owners can perform flow operations. VPC endpoint association owners who do not also own the main firewall cannot perform flow operations on that firewall. For more information, see [Firewalls and firewall endpoints in AWS Network Firewall](./firewalls.html). + @@ -64 +66 @@ We throttle flush and capture operations to one concurrent request per firewall -For information on how Network Firewall propagates changes you make, see [Managing your firewall in AWS Network Firewall](./firewall-managing.html). +For information on how Network Firewall propagates changes you make, see [Managing a firewall and firewall endpoints in AWS Network Firewall](./firewall-managing.html). @@ -72 +74 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Deleting a firewall +Deleting a VPC endpoint association