AWS network-manager documentation change
Summary
Updated core network configuration documentation to add security group referencing support, VPN ECMP support, and DNS support parameters with explanations. Added a detailed configuration example.
Security assessment
The change adds documentation for 'security-group-referencing-support' parameter which enables cross-VPC security group references. While this relates to security configuration management, there is no evidence of addressing a specific vulnerability. The documentation improvement helps users understand security controls but doesn't fix a known issue.
Diff
diff --git a/network-manager/latest/cloudwan/cloudwan-policies-json.md b/network-manager/latest/cloudwan/cloudwan-policies-json.md index 43c3b40dc..614d4fca2 100644 --- a//network-manager/latest/cloudwan/cloudwan-policies-json.md +++ b//network-manager/latest/cloudwan/cloudwan-policies-json.md @@ -9 +9 @@ core-network-configurationsegmentsnetwork-function-groupssegment-actionsattachme -The following sections describe the parameters that you use to create a core network policy version using JSON. Your JSON file contains two sections that describe the policy network settings and segments. You can then add two optional sections for defining segment actions and attachment policies. +The following sections describe the parameters that you use to create a core network policy version using JSON. Your JSON file contains two sections that describe the policy network settings and segments. You can then add optional sections for defining network function groups and segment actions. @@ -38 +38 @@ The following parameters are used in `core-network-configuration`: - * `asn-ranges` — The Autonomous System Numbers (ASNs) to assign to Core Network Edges. By default, the core network automatically assigns an ASN for each Core Network Edge, but you can optionally define the ASN in the `edge-locations` for each Region. The ASN uses an array of integer ranges only from `64512` to `65534` and `4200000000` to `4294967294`. No other ASN ranges can be used. + * General settings allow you to create the foundation of a core network, including whether VPN ECMP, DNS, and security group referencing are supported. @@ -40 +40 @@ The following parameters are used in `core-network-configuration`: -For example, you might have the following: + * `vpn-ecmp-support `— (Optional) Indicates whether the core network forwards traffic over multiple equal-cost routes using VPN. The value can be either `true` or `false`. When set to `true`, traffic can be distributed across multiple VPN tunnels for better throughput and redundancy. The default is `true`. @@ -42,4 +42,8 @@ For example, you might have the following: - "asn-ranges": [ - "64512-65534", - "4200000000-4294967294" - ], + * `dns-support` — (Optional) Indicates whether DNS resolution is enabled for the core network. The value can be either `true` or `false`. When set to `true`, DNS resolution is enabled for VPCs attached to the core network, allowing resources in different VPCs to resolve each other's domain names. The default is `true`. For more information, see [DNS support](./cloudwan-vpc-attachment.html#cloudwan-dns-support). + + * `security-group-referencing-support` — (Optional) Indicates whether security group referencing is enabled for the core network. The value can be either `true` or `false`. When set to `true`, security groups in one VPC can reference security groups in another VPC attached to the core network, enabling more flexible security configurations across your network. The default is `false`. For more information about security group referencing, see [Security group referencing](./cloudwan-vpc-attachment.html#cloudwan-sg-referencing). + + + + + * `asn-ranges` — The Autonomous System Numbers (ASNs) to assign to Core Network Edges. By default, the core network automatically assigns an ASN for each Core Network Edge, but you can optionally define the ASN in the `edge-locations` for each Region. The ASN uses an array of integer ranges only from `64512` to `65534` and `4200000000` to `4294967294`. No other ASN ranges can be used. @@ -65,0 +70,25 @@ You can't change the ASN of a Core Network Edge. Any transit gateway with the sa +For example, you might have the following core network configuration. This core network configuration establishes a Cloud WAN core network with VPN ECMP and DNS support enabled, while disabling security group referencing across VPCs. It allocates two internal CIDR blocks (`10.0.0.0/16` and `10.1.0.0/16`) for network connectivity, defines an ASN range of `65000-65100`, and deploys a single edge location in `us-east-1`, providing the foundation for a managed wide area network. + + + { + "version": "2021.12", + "core-network-configuration": { + "vpn-ecmp-support": true, + "dns-support": true, + "security-group-referencing-support": false, + "inside-cidr-blocks": [ + "10.0.0.0/16", + "10.1.0.0/16" + ], + "asn-ranges": [ + "65000-65100" + ], + "edge-locations": [ + { + "location": "us-east-1" + } + ] + } + ... + } +