AWS network-firewall documentation change
Summary
Updated documentation to clarify subnet configuration for primary VPC and added guidance about expanding firewall protections to additional VPCs/subnets
Security assessment
The changes clarify deployment architecture and scalability but do not address specific security vulnerabilities or introduce new security features. Focuses on proper subnet segregation and multi-VPC management.
Diff
diff --git a/network-firewall/latest/developerguide/firewall-high-level-steps.md b/network-firewall/latest/developerguide/firewall-high-level-steps.md index 41b91c909..f1b53ee7b 100644 --- a//network-firewall/latest/developerguide/firewall-high-level-steps.md +++ b//network-firewall/latest/developerguide/firewall-high-level-steps.md @@ -9 +9,3 @@ To install and use an AWS Network Firewall firewall in your Amazon Virtual Priva - * **Configure the VPC subnets for your firewall endpoints** – In your VPC, in each Availability Zone where you want a firewall endpoint, create a subnet specifically for use by Network Firewall. A firewall endpoint can't protect applications that run in the same subnet, so reserve these subnets for exclusive use by the firewall. The subnets that you use for your firewall endpoints must belong to a single AWS Region and must be in different Availability Zones within the Region. Network Firewall is available in the Regions listed at [AWS service endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html). + * **Configure the primary VPC subnets for your firewall endpoints** – In the primary VPC where you'll use the firewall, in each Availability Zone where you want a firewall endpoint, create a subnet specifically for use by Network Firewall. A firewall endpoint can't protect applications that run in the same subnet, so reserve these subnets for exclusive use by the firewall. The subnets that you use for your primary firewall endpoints must belong to a single AWS Region and must be in different Availability Zones within the Region. + +Network Firewall is available in the Regions listed at [AWS service endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html). @@ -23,0 +26,2 @@ For information about managing route tables for your VPC, see [Route tables](htt +After you implement a firewall, you can expand its protections to additional VPCs and to multiple subnets within a single Availability Zone for any VPC. To do this, you manage the VPCs, subnets, and route tables as described in the previous high level steps, but you create the firewall endpoints in VPC endpoint associations, using the firewall that you've already defined. For more information about managing firewalls and VPC endpoint associations, see [Firewalls and firewall endpoints in AWS Network Firewall](./firewalls.html). +