AWS efs documentation change
Summary
Updated mount target configuration details with IPv4/IPv6 support requirements, added encryption at rest documentation, and reorganized recommended settings
Security assessment
The changes add documentation about encryption of data at rest (a security feature) and clarify IP address type requirements. While these relate to security best practices, there is no evidence of addressing a specific security vulnerability. The IP type alignment note helps prevent misconfigurations but doesn't reference a known exploit.
Diff
diff --git a/efs/latest/ug/creating-using-create-fs.md b/efs/latest/ug/creating-using-create-fs.md index 24c1449fd..a582a3b41 100644 --- a//efs/latest/ug/creating-using-create-fs.md +++ b//efs/latest/ug/creating-using-create-fs.md @@ -25 +25 @@ When creating the file system using the Amazon EFS console, you have different o - * Mount targets configured in each Availability Zone in the AWS Region in which the file system is created + * Mount targets configured in each Availability Zone in the AWS Region in which the file system is created using an available IPv4 on the specified subnet @@ -93 +93,6 @@ Due to the higher per-operation latencies with Max I/O, we recommend using Gener - * **IP address** \- By default, Amazon EFS creates the mount target at an available address on the specified subnet. Alternately, you can specify the IP address for the mount target. You can't change the IP address of a mount target after it's created. You need to delete the mount target and create a new one with the new address. + * **IP address type** – By default, Amazon EFS uses an IPv4 address at which to create the mount target. You can alternatively choose **IPv6 only** to support IPv6 addresses only, or **Dual-stack** to support both IPv4 and IPv6 addresses. + +###### Note + +The IP address type must match the IP type of the subnet. Additionally, the IP address type overrides the IP addressing attribute of your subnet. For example, if the IP address type is IPv4-only and the IPv6 addressing attribute is enabled for your subnet, network interfaces created in the subnet receive an IPv4 address from the range of the subnet. For more information, see [Modify the IP addressing attributes of your subnet](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html). + * **IP address** – By default, Amazon EFS creates the mount target at an available address on the specified subnet. Alternately, you can specify the IP address for the mount target. You can't change the IP address of a mount target after it's created. You need to delete the mount target and create a new one with the new address. @@ -112 +117 @@ Use the Amazon EFS console to create an Amazon EFS file system that has the reco - * Regional availability. + * Regional availability @@ -114 +119 @@ Use the Amazon EFS console to create an Amazon EFS file system that has the reco - * General Purpose performance mode. + * Lifecycle policies to transition the file system to EFS Infrequent Access (IA) storage after 30 days, to EFS Archive storage after 90 days, and not to transition to EFS Standard storage @@ -116 +121 @@ Use the Amazon EFS console to create an Amazon EFS file system that has the reco - * Elastic throughput mode. + * Encryption of data at rest enabled @@ -118 +123 @@ Use the Amazon EFS console to create an Amazon EFS file system that has the reco - * Encryption of data at rest enabled. + * Elastic throughput mode @@ -120 +125 @@ Use the Amazon EFS console to create an Amazon EFS file system that has the reco - * Lifecycle management policies to transition into IA and Archive storage. + * General Purpose performance mode @@ -122 +127 @@ Use the Amazon EFS console to create an Amazon EFS file system that has the reco - * Mount targets configured in each Availability Zone in the AWS Region in which the file system is created. + * Mount targets configured in each Availability Zone in the AWS Region in which the file system is created, using an available IPv4 on the specified subnet @@ -217 +222,3 @@ In Step 2, you configure the file system's network settings, including the VPC a - * **IP Address** – By default, Amazon EFS chooses the IP address automatically from the available addresses in the subnet. Or, you can enter a specific IP address that's in the subnet. Although mount targets have a single IP address, they are redundant, highly available network resources. + * **IP address type** – Choose **IPv4 only** to support IPv4 addresses only, **IPv6 only** to support IPv6 addresses only, or **Dual-stack** to support both IPv4 and IPv6 addresses. + + * **IPv4 or IPv6 address** – If you know the IP address where you want to place the mount target, then enter it in the IP address box that matches the **IP address type**. If you don't specify a value, Amazon EFS selects an unused IP address from the specified subnet.