AWS network-firewall documentation change
Summary
Expanded documentation about VPC endpoint associations and multi-VPC configurations
Security assessment
Changes clarify network architecture options but don't directly address security features or vulnerabilities
Diff
diff --git a/network-firewall/latest/developerguide/vpc-config-subnets.md b/network-firewall/latest/developerguide/vpc-config-subnets.md index 6f2253f8a..91baa58c9 100644 --- a//network-firewall/latest/developerguide/vpc-config-subnets.md +++ b//network-firewall/latest/developerguide/vpc-config-subnets.md @@ -7 +7 @@ -When you associate a firewall to your VPC, you must provide a subnet for each Availability Zone where you want to place a firewall endpoint to filter traffic. A common configuration is to have a firewall endpoint in each zone where you have customer subnets that you want to protect, but you can also have a firewall endpoint filter traffic from multiple zones. When you create the firewall, Network Firewall adds a firewall endpoint to each of the designated subnets. Each firewall endpoint uses the firewall's associated firewall policy configuration to filter traffic that you route through it. +When you associate a firewall to your VPC, you must provide a subnet for each Availability Zone where you want to place a firewall endpoint to filter traffic. A common configuration is to have a firewall endpoint in each zone where you have customer subnets that you want to protect, but you can also have a firewall endpoint filter traffic from multiple zones. @@ -9 +9 @@ When you associate a firewall to your VPC, you must provide a subnet for each Av -To prepare your VPC for your Network Firewall firewall, in each Availability Zone where you want a firewall endpoint, create a subnet for the endpoint. Each subnet must have at least one IP address available. Your can't change the IP address type after you create the subnet. +Additionally, you can use VPC endpoint associations to define multiple endpoints in an Availability Zone and to use the firewall for VPCs other than the one specified in the firewall. For any subnet where you use a firewall, the VPC subnet management described here is the same. @@ -11 +11,9 @@ To prepare your VPC for your Network Firewall firewall, in each Availability Zon -Network Firewall supports up to 100 Gbps of network traffic per firewall endpoint. If you require more traffic bandwidth, you can split your resources into subnets and create a Network Firewall firewall in each subnet. +###### Note + +If you plan to use your firewall for multiple VPCs, the additional VPCs can only have firewall endpoints defined in Availability Zones where the firewall already has endpoints defined for the primary VPC. + +When you create the firewall or define a VPC endpoint association, Network Firewall adds a firewall endpoint to each of the subnets that you've specified. Each firewall endpoint uses the firewall's associated firewall policy configuration to filter traffic that you route through it. + +To prepare a VPC for your Network Firewall firewall, in each Availability Zone where you want a firewall endpoint, create the subnets that you will use for the endpoints. Each subnet must have at least one IP address available. Your can't change the IP address type after you create the subnet. + +Network Firewall supports up to 100 Gbps of network traffic per firewall endpoint. If you require more traffic bandwidth, you can define additional endpoints in VPC endpoint associations, or you can split your resources into subnets and create a Network Firewall firewall in each subnet. @@ -19 +27 @@ For information about managing subnets in your VPC, see [VPCs and subnets](https -When you create your Network Firewall firewall, you must provide at least one zone and subnet for the firewall configuration. You can add and remove subnets after you create a firewall. +When you create your Network Firewall firewall, you must provide at least one zone and subnet for the firewall configuration. You can add and remove subnets after you create a firewall. You can manage VPC endpoint associations for any firewall that you've created or that has been shared with you.