AWS network-firewall documentation change
Summary
Updated resource definitions for Network Firewall, adding VPC endpoint association concept and clarifying firewall configuration details
Security assessment
The changes enhance documentation about firewall endpoint configuration and multi-VPC protection capabilities, which are security features. However, there is no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/network-firewall/latest/developerguide/what-is-aws-network-firewall.md b/network-firewall/latest/developerguide/what-is-aws-network-firewall.md index f8100fbd4..6ff75ed1c 100644 --- a//network-firewall/latest/developerguide/what-is-aws-network-firewall.md +++ b//network-firewall/latest/developerguide/what-is-aws-network-firewall.md @@ -30 +30 @@ You can use Network Firewall to monitor and protect your Amazon VPC traffic in a -To enable Network Firewall for your VPC, you perform steps in both Amazon VPC and in Network Firewall. For information about managing your Amazon Virtual Private Cloud VPC, see the [Amazon Virtual Private Cloud User Guide](https://docs.aws.amazon.com/vpc/latest/userguide). For more information about how Network Firewall works, see [How AWS Network Firewall works](./how-it-works.html). +To enable Network Firewall for a VPC, you perform steps in both Amazon VPC and in Network Firewall. For information about managing your Amazon Virtual Private Cloud VPC, see the [Amazon Virtual Private Cloud User Guide](https://docs.aws.amazon.com/vpc/latest/userguide). For more information about how Network Firewall works, see [How AWS Network Firewall works](./how-it-works.html). @@ -57 +57,3 @@ Network Firewall manages the following AWS resource types: - * **Firewall** – Provides traffic filtering logic for the subnets in a VPC. + * **Firewall** – Provides traffic filtering logic for a VPC. The Firewall defines the primary VPC to protect and a primary subnet to use for a firewall endpoint in each Availability Zone. + + * **VpcEndpointAssociation** – Provides additional firewall endpoints for a Firewall, in the primary VPC and other VPCs. @@ -74 +76 @@ The following are the key concepts for Network Firewall: - * **Internet gateway** – A gateway that you attach to your VPC to enable communication between resources in your VPC and the internet. + * **Internet gateway** – A gateway that you attach to a VPC to enable communication between resources in the VPC and the internet. @@ -76 +78 @@ The following are the key concepts for Network Firewall: - * **Subnet** – A range of IP addresses in your VPC. Network Firewall creates firewall endpoints in subnets inside your VPC, to filter network traffic. In a VPC architecture that uses Network Firewall, the firewall endpoints sit between your protected subnets and locations outside your VPC. + * **Subnet** – A range of IP addresses in a VPC. Network Firewall creates firewall endpoints in subnets inside your VPC, to filter network traffic. In a VPC architecture that uses Network Firewall, the firewall endpoints sit between your protected subnets and locations outside your VPC. @@ -82 +84,3 @@ The following are the key concepts for Network Firewall: - * **Network Firewall _firewall_** – An AWS resource that provides traffic filtering logic for the subnets in a VPC. + * **Network Firewall _firewall_** – An AWS resource that provides traffic filtering logic, and that defines the primary VPC to protect and a subnet in each Availability Zone for that VPC to use for firewall endpoints. + + * **Network Firewall _VPC endpoint association_** – An AWS resource that defines a firewall endpoint in addition to the primary endpoints that the firewall defines, and uses the firewall's traffic filtering logic and other settings. A VPC endpoint association can be for the firewall's VPC or for another VPC.