AWS network-firewall documentation change
Summary
Expanded documentation on firewall and firewall endpoint architecture, including primary/secondary endpoints, VPC endpoint associations, and cross-account sharing considerations.
Security assessment
The updates clarify firewall deployment and management concepts but do not directly discuss security controls, vulnerabilities, or new security features. Mentions of cross-account sharing relate to resource management, not explicit security enhancements.
Diff
diff --git a/network-firewall/latest/developerguide/firewalls.md b/network-firewall/latest/developerguide/firewalls.md index 02d707e4d..e59640c48 100644 --- a//network-firewall/latest/developerguide/firewalls.md +++ b//network-firewall/latest/developerguide/firewalls.md @@ -5 +5 @@ -# Firewalls in AWS Network Firewall +# Firewalls and firewall endpoints in AWS Network Firewall @@ -7 +7,7 @@ -An AWS Network Firewall _firewall_ connects a firewall policy, which defines network traffic monitoring and filtering behavior, to the VPC that you want to protect. The firewall configuration includes specifications for the Availability Zones and subnets where the firewall endpoints are placed. It also defines high-level settings like the firewall logging configuration and tagging on the AWS firewall resource. +A Network Firewall _firewall_ defines the behavior of a network firewall, specifies the primary VPC it protects, and determines the Availability Zones where it can be deployed. For each Availability Zone where you want to use the firewall, you must define one subnet to serve as a _firewall endpoint_ in the firewall's configuration. These are the primary endpoints for your firewall. + +To extend your firewall's capabilities, you can create additional, or secondary, firewall endpoints using _VPC endpoint associations_. These associations let you deploy firewall endpoints in VPCs other than the primary protected VPC and create multiple firewall endpoints within a single Availability Zone in the firewall owner's account or other accounts with which the firewall has been shared. For information about sharing firewalls with other accounts, see [Sharing Network Firewall resources](./sharing.html). + +You can create VPC endpoint associations for any VPC, but only in Availability Zones where the firewall already has a primary endpoint defined. For details about creating these associations, see [Creating a VPC endpoint association](./creating-vpc-endpoint-association.html). + +This guide shows you how to create, manage, and troubleshoot firewalls and their endpoints, whether you're working with primary firewall endpoints or VPC endpoint associations. @@ -10,0 +17,2 @@ An AWS Network Firewall _firewall_ connects a firewall policy, which defines net + * [Considerations for working with firewalls and firewall endpoints](./firewall-and-firewall-endpoints-considerations.html) + @@ -13 +21,3 @@ An AWS Network Firewall _firewall_ connects a firewall policy, which defines net - * [Managing your firewall in AWS Network Firewall](./firewall-managing.html) + * [Understanding the differences between firewall owners and VPC endpoint association owners](./firewall-owners-and-vpc-endpoint-association-owners.html) + + * [Managing a firewall and firewall endpoints in AWS Network Firewall](./firewall-managing.html) @@ -30 +40 @@ Transit gateway attachments -Firewall settings +Considerations