AWS network-firewall documentation change
Summary
Added operational guidance for shared firewall environments, clarified flow operation scoping (primary/VPC endpoints), restructured configuration steps, and updated protocol documentation
Security assessment
The changes focus on operational best practices (notifying VPC endpoint owners) and clarifying configuration steps for flow operations. While important for reliability, there's no evidence of addressing a security vulnerability or weakness. The minimum age recommendation removal (60 seconds) might impact operational safety but isn't explicitly security-related.
Diff
diff --git a/network-firewall/latest/developerguide/flow-operations-flush.md b/network-firewall/latest/developerguide/flow-operations-flush.md index a22de5258..29d8a28d0 100644 --- a//network-firewall/latest/developerguide/flow-operations-flush.md +++ b//network-firewall/latest/developerguide/flow-operations-flush.md @@ -27,0 +28,4 @@ Flush operations cannot be cancelled once started. If you haven't already review +###### Tip + +If your firewall is shared with other AWS accounts through VPC endpoint associations, take care to notify VPC endpoint association owners before you flush flows from the primary firewall. + @@ -38 +42,5 @@ Flush operations cannot be cancelled once started. If you haven't already review - 5. Configure the flow filters to determine the scope of the operation: + 5. Configure the scope of the flow operation, depending on your firewall configuration: + + * To perform the operation in the primary firewall endpoint only, define the VpcEndpointId. + + * To perform the operation in a VPC endpoint association only, define the VPC endpoint association ARN. @@ -40 +48 @@ Flush operations cannot be cancelled once started. If you haven't already review - 1. Define an Availability Zone and ARN for the operation. + * To perform the operation in the primary firewall endpoint and all associated VPC endpoints, define the Availability Zone of the primary firewall endpoint. @@ -42 +50 @@ Flush operations cannot be cancelled once started. If you haven't already review - 2. Optionally, define additional filters: + 6. Optionally, configure additional flow filters to further customize the scope of the operation: @@ -44 +52 @@ Flush operations cannot be cancelled once started. If you haven't already review - * **Minimum age** \- To exclude recently established flows, set this value to filter out flows that are newer than the specified age, in seconds. We recommend setting this value to at least 60 seconds to reduce the chance of impacting flows that are not yet established. + * **Minimum age** \- To exclude recently established flows, set this value to filter out flows that are newer than the specified age, in seconds @@ -46 +54 @@ Flush operations cannot be cancelled once started. If you haven't already review - * **Source** \- A single IP address, a range of IPs (CIDR), or port. + * **Source** \- A single IP address, a range of IPs (CIDR), or port @@ -48 +56 @@ Flush operations cannot be cancelled once started. If you haven't already review - * **Destination** \- A single IP address, a range of IPs (CIDR), or port. + * **Destination** \- A single IP address, a range of IPs (CIDR), or port @@ -50 +58 @@ Flush operations cannot be cancelled once started. If you haven't already review - * **Protocol number** \- The assigned internet protocol number (IANA) for each supported protocol. If left empty, the operation applies to flows with any supported protocol (TCP, UDP, ICMP, ICMPv6, SCTP). + * **Protocol number** \- The assigned internet protocol number (IANA) for each supported protocol. If left empty, the operation captures flows with any supported protocol (TCP, UDP, ICMP, ICMPv6, SCTP). @@ -52 +60 @@ Flush operations cannot be cancelled once started. If you haven't already review - 6. Review your configured filters in the **Filters** section. + 7. Review your configured filters in the **Filters** section. @@ -54 +62 @@ Flush operations cannot be cancelled once started. If you haven't already review - 7. Choose **Start flush** , then confirm that you want to begin the operation. + 8. Choose **Start flush** , then confirm that you want to begin the operation. @@ -56 +64 @@ Flush operations cannot be cancelled once started. If you haven't already review - 8. Return to the firewall **Details** page to monitor the operation status. + 9. Return to the firewall **Details** page to monitor the operation status.