AWS AWSEC2 medium security documentation change
Summary
Updated EFA network interface creation steps with new interface types (EFA with ENA or ENA-only), added IP configuration details, and introduced connection tracking timeout settings
Security assessment
Added configuration for idle connection tracking timeouts (TCP/UDP) which impacts security group behavior. These settings help control how long inactive connections are maintained, reducing exposure to potential stale connection exploitation. Specific timeout ranges and recommendations are provided.
Diff
diff --git a/AWSEC2/latest/UserGuide/create-efa.md b/AWSEC2/latest/UserGuide/create-efa.md index 47e31a2c2..ef2008353 100644 --- a//AWSEC2/latest/UserGuide/create-efa.md +++ b//AWSEC2/latest/UserGuide/create-efa.md @@ -44 +44 @@ Console -###### To create an EFA (EFA with ENA) network interface +###### To create an EFA (EFA with ENA or ENA-only) network interface @@ -48 +48 @@ Console - 2. In the navigation pane, choose **Network Interfaces**. + 2. In the navigation pane, choose **Network Interfaces** and then choose **Create network interface**. @@ -50 +50 @@ Console - 3. Choose **Create Network Interface**. + 3. For **Description** , enter a descriptive name for the EFA. @@ -52 +52 @@ Console - 4. For **Description** , enter a descriptive name for the EFA. + 4. For **Subnet** , select the subnet in which to create the EFA. @@ -54 +54 @@ Console - 5. For **Subnet** , select the subnet in which to create the EFA. + 5. **Interface type** , choose one of the following options: @@ -56 +56 @@ Console - 6. For **Private IP** , enter the primary private IPv4 address. If you don't specify an IPv4 address, we select an available private IPv4 address from the selected subnet. + * **EFA with ENA** — To create a network interface that supports both ENA and EFA devices. @@ -58 +58 @@ Console - 7. (_Optional_) If you selected a subnet that has an associated IPv6 CIDR block, you can optionally specify an IPv6 address in the **IPv6 IP** field. + * **EFA-only** — To create a network interface with an EFA device only. @@ -60 +60 @@ Console - 8. For **Security groups** , select one or more security groups. + 6. (For EFA with ENA only) Configure the IP address and prefix assignment for the network interface. The type of IP addresses and prefixes you can assign depend on the selected subnet. For IPv4-only subnets, you can assign IPv4 IP addresses and prefixes only. For IPv6-only subnets, you can assign IPv6 IP addresses and prefixes only. For dual-stack subnets, you can assign both IPv4 and IPv6 IP addresses and prefixes. @@ -62 +62 @@ Console - 9. For **Elastic Fabric Adapter** , select **Enable**. +###### Note @@ -64 +64 @@ Console - 10. Choose **Create network interface**. +You can't assign IP addresses to an EFA-only network interface. @@ -65,0 +66 @@ Console + 1. For **Private IPv4 address** and/or **IPv6 address** , choose **Auto-assign** to have Amazon EC2 automatically assign an IP address from the selected subnet, or choose **Custom** to manually specify the IP address to assign. @@ -66,0 +68 @@ Console + 2. If you assign an IPv6 address, you can optionally enable **Assign primary IPv6 IP**. Doing this assigns a primary IPv6 global unicast address (GUA) to the network interface. Assigning a primary IPv6 address enables you to avoid disrupting traffic to instances or ENIs. For more information, see [IPv6 addresses](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html#vpc-ipv6-addresses). @@ -67,0 +70 @@ Console + 3. For **IPv4 prefix delegation** and/or **IPv6 prefix delegation** , choose **Auto-assign** to have Amazon EC2 automatically assign a prefix from the subnet's CIDR block, or choose **Custom** to manually specify a prefix from the subnet's CIDR block. If you specify a prefix, AWS verifies that it is not already assigned to another resource. For more information, see [Prefix delegation for Amazon EC2 network interfaces](./ec2-prefix-eni.html) @@ -69 +72 @@ Console -###### To create an EFA-only network interface + 4. (Optional) Configure the **Idle connection tracking timeout** settings. For more information, see [Idle connection tracking timeout](./security-group-connection-tracking.html#connection-tracking-timeouts) @@ -71,3 +74 @@ Console - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). - - 2. In the navigation pane, choose **Network Interfaces**. + * **TCP established timeout** — The timeout period, in seconds, for idle TCP connections in an established state. Min: 60 seconds. Max: 432000 seconds (5 days). Default: 432000 seconds. Recommended: Less than 432000 seconds. @@ -75 +76 @@ Console - 3. Expand the **Create Network Interface** drop-down and choose **Create EFA Only network interface**. + * **UDP timeout** — The timeout period, in seconds, for idle UDP flows that have seen traffic only in a single direction or a single request-response transaction. Min: 30 seconds. Max: 60 seconds. Default: 30 seconds. @@ -77 +78 @@ Console - 4. For **Description** , enter a descriptive name for the EFA. + * **UDP stream timeout** — The timeout period, in seconds, for idle UDP flows classified as streams that have seen more than one request-response transaction. Min: 60 seconds. Max: 180 seconds (3 minutes). Default: 180 seconds. @@ -79 +80 @@ Console - 5. For **Subnet** , select the subnet in which to create the EFA. + 7. For **Security groups** , select one or more security groups. @@ -81 +82 @@ Console - 6. Choose **Create network interface**. + 8. Choose **Create network interface**.