AWS vpc documentation change
Summary
Clarified that private DNS creation for resource VPC endpoints applies only to select resource configurations using ARNs
Security assessment
The change narrows the scope of when AWS creates private hosted zones but does not address a security vulnerability or document security features.
Diff
diff --git a/vpc/latest/privatelink/privatelink-access-resources.md b/vpc/latest/privatelink/privatelink-access-resources.md index 07457b306..34bb1fbb7 100644 --- a//vpc/latest/privatelink/privatelink-access-resources.md +++ b//vpc/latest/privatelink/privatelink-access-resources.md @@ -102 +102 @@ The DNS records that we create for your resource VPC endpoint are public. Theref -If you enable private DNS for your resource VPC endpoint, and your VPC has both [DNS hostnames and DNS resolution](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-updating) enabled, we create hidden, AWS-managed private hosted zones for resource configurations with a custom DNS name. The hosted zone contains a record set for the default DNS name for the resource that resolves it to the private IP addresses of the resource endpoint's network interfaces in your VPC. +If you enable private DNS for your resource VPC endpoint for select resource configurations that use ARNs, and your VPC has both [DNS hostnames and DNS resolution](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-updating) enabled, we create hidden, AWS-managed private hosted zones for resource configurations with a custom DNS name. The hosted zone contains a record set for the default DNS name for the resource that resolves it to the private IP addresses of the resource endpoint's network interfaces in your VPC.