AWS vpn documentation change
Summary
Added Pre-shared key storage type selection (Standard vs Secrets Manager) and renumbered steps
Security assessment
Introduces Secrets Manager as an option for storing pre-shared keys, which enhances security by using a dedicated secrets management service rather than storing keys directly in the VPN service. This is a security feature addition rather than addressing a specific vulnerability.
Diff
diff --git a/vpn/latest/s2svpn/SetUpVPNConnections.md b/vpn/latest/s2svpn/SetUpVPNConnections.md index 5504720b7..f971595b4 100644 --- a//vpn/latest/s2svpn/SetUpVPNConnections.md +++ b//vpn/latest/s2svpn/SetUpVPNConnections.md @@ -285 +285 @@ Create the VPN connection using the customer gateway in combination with the vir - 6. Select one of the routing options based on whether your customer gateway device supports Border Gateway Protocol (BGP): + 6. Select one of the **Routing options** based on whether your customer gateway device supports Border Gateway Protocol (BGP): @@ -291 +291 @@ Create the VPN connection using the customer gateway in combination with the vir - 7. If your target gateway type is transit gateway, for **Tunnel inside IP version** , specify whether the VPN tunnels support IPv4 or IPv6 traffic. IPv6 traffic is only supported for VPN connections on a transit gateway. + 7. Choose the Pre-shared key storage type: @@ -293 +293,7 @@ Create the VPN connection using the customer gateway in combination with the vir - 8. If you specified **IPv4** for **Tunnel inside IP version** , you can optionally specify the IPv4 CIDR ranges for the customer gateway and AWS sides that are allowed to communicate over the VPN tunnels. The default is `0.0.0.0/0`. + * **Standard** — The pre-shared key is stored directly in the Site-to-Site VPN service. + + * **Secrets Manager** — The pre-shared key is stored using AWS Secrets Manager. For more information about Secrets Manager, see [Enhanced security features using Secrets Manager](./enhanced-security.html). + + 8. If your target gateway type is transit gateway, for **Tunnel inside IP version** , specify whether the VPN tunnels support IPv4 or IPv6 traffic. IPv6 traffic is only supported for VPN connections on a transit gateway. + + 9. If you specified **IPv4** for **Tunnel inside IP version** , you can optionally specify the IPv4 CIDR ranges for the customer gateway and AWS sides that are allowed to communicate over the VPN tunnels. The default is `0.0.0.0/0`. @@ -297 +303 @@ If you specified **IPv6** for **Tunnel inside IP version** , you can optionally - 9. For **Outside IP address type** , keep the default option, **PublicIpv4**. + 10. For **Outside IP address type** , keep the default option, **PublicIpv4**. @@ -299 +305 @@ If you specified **IPv6** for **Tunnel inside IP version** , you can optionally - 10. (Optional) For **Tunnel options** , you can specify the following information for each tunnel: + 11. (Optional) For **Tunnel options** , you can specify the following information for each tunnel: @@ -309 +315 @@ If you specified **IPv6** for **Tunnel inside IP version** , you can optionally - 11. Choose **Create VPN connection**. It might take a few minutes to create the VPN connection. + 12. Choose **Create VPN connection**. It might take a few minutes to create the VPN connection.