AWS AWSCloudFormation medium security documentation change
Summary
Clarified IP address selection logic, added default security group behavior, and specified subnet type requirement
Security assessment
The change explicitly documents that EFS will use the VPC's default security group if none are specified. This has security implications as default security groups might have overly permissive rules. The documentation update helps users understand potential security configuration risks.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-efs-mounttarget.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-efs-mounttarget.md index dbe2318e0..e31ad3379 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-efs-mounttarget.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-efs-mounttarget.md @@ -61 +61 @@ _Maximum_ : `128` -Valid IPv4 address within the address range of the specified subnet. +If the `IpAddressType` for the mount target is IPv4 ( `IPV4_ONLY` or `DUAL_STACK`), then specify the IPv4 address to use. If you do not specify an `IpAddress`, then Amazon EFS selects an unused IP address from the subnet specified for `SubnetId`. @@ -78 +78 @@ _Minimum_ : `7` -VPC security group IDs, of the form `sg-xxxxxxxx`. These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see [Amazon VPC Quotas](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html) in the _Amazon VPC User Guide_ (see the **Security Groups** table). +VPC security group IDs, of the form `sg-xxxxxxxx`. These must be for the same VPC as the subnet specified. The maximum number of security groups depends on account quota. For more information, see [Amazon VPC Quotas](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html) in the _Amazon VPC User Guide_ (see the **Security Groups** table). If you don't specify a security group, then Amazon EFS uses the default security group for the subnet's VPC. @@ -91 +91 @@ _Required_ : Yes -The ID of the subnet to add the mount target in. For One Zone file systems, use the subnet that is associated with the file system's Availability Zone. +The ID of the subnet to add the mount target in. For One Zone file systems, use the subnet that is associated with the file system's Availability Zone. The subnet type must be the same type as the `IpAddressType`.