AWS AmazonCloudWatch documentation change
Summary
Clarified limitations of Network Health Indicator (NHI) for AWS Direct Connect with intermediary routing (Cloud WAN, Transit Gateway), advising against relying on NHI in such cases.
Security assessment
The change clarifies monitoring tool limitations to prevent misconfiguration. While incorrect monitoring could impact security visibility, there is no evidence of a specific security vulnerability being addressed. The update is a usage guidance improvement rather than a security fix.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/nw-monitor-how-it-works.md b/AmazonCloudWatch/latest/monitoring/nw-monitor-how-it-works.md index 4ae3053bf..1db229be7 100644 --- a//AmazonCloudWatch/latest/monitoring/nw-monitor-how-it-works.md +++ b//AmazonCloudWatch/latest/monitoring/nw-monitor-how-it-works.md @@ -57 +57 @@ TCP-based probes carry TCP SYN packets from your AWS hosted resources to the des -Network Synthetic Monitor publishes a network health indicator (NHI) metric that provides information on issues with the AWS network for paths that include destinations connected through AWS Direct Connect. NHI is not supported for AWS Direct Connect attachments that are created using Cloud WAN or that use AWS Transit Gateway. The NHI binary value is based on a statistical measure of the health of the AWS-controlled network path from the AWS hosted resource, where the monitor is deployed, to the Direct Connect location. +Network Synthetic Monitor publishes a network health indicator (NHI) metric that provides information on issues with the AWS network for paths that include destinations connected through AWS Direct Connect. @@ -59 +59,3 @@ Network Synthetic Monitor publishes a network health indicator (NHI) metric that -Network Synthetic Monitor uses anomaly detection to calculate availability drops or lower performance along the network paths. +The NHI binary value is based on a statistical measure of the health of the AWS-controlled network path from the AWS hosted resource, where the monitor is deployed, to the Direct Connect location. Network Synthetic Monitor uses anomaly detection to calculate availability drops or lower performance along the network paths. + +NHI is not accurate for AWS Direct Connect attachments that use intermediary routing, such as connections that are created using Cloud WAN or that use AWS Transit Gateway. When you have a hybrid network that includes AWS Transit Gateway or other intermediary routing segments, do not use the NHI value as an indication of a performance issue.