AWS vpc documentation change
Summary
Restructured route table documentation by removing embedded route priority details and linking to a dedicated page. Added more descriptive text about route table functionality and updated related links.
Security assessment
The changes primarily reorganize existing content and improve documentation structure. While route tables are security-relevant infrastructure, there's no evidence of addressing a specific vulnerability or adding new security guidance. The removed route priority content was moved to a dedicated page rather than being security-related.
Diff
diff --git a/vpc/latest/userguide/VPC_Route_Tables.md b/vpc/latest/userguide/VPC_Route_Tables.md index 43bc10340..eb6111c4f 100644 --- a//vpc/latest/userguide/VPC_Route_Tables.md +++ b//vpc/latest/userguide/VPC_Route_Tables.md @@ -5,2 +4,0 @@ -Route priority - @@ -9 +7,3 @@ Route priority -A _route table_ contains a set of rules, called _routes_ , that determine where network traffic from your subnet or gateway is directed. +A _route table_ serves as the traffic controller for your virtual private cloud (VPC). Each route table contains a set of rules, called _routes_ , that determine where network traffic from your subnet or gateway is directed. When you create a VPC, we also create the main route table for the VPC. You can create additional route tables for your VPC, so that you have more granular control over the network paths for your VPC. + +You can use route tables to specify which networks your VPC can communicate with, such as other VPCs or on-premises networks. Each route specifies a destination (CIDR block or prefix list) and a target (such as an internet gateway, NAT gateway, VPC peering connection, or VPN connection). Traffic is routed to targets based on its destination IP address. Route tables enable you to create complex networking architectures that include public subnets, private subnets, VPN-only subnets, and isolated subnets. @@ -19 +19 @@ A _route table_ contains a set of rules, called _routes_ , that determine where - * Route priority + * [Route priority](./route-tables-priority.html) @@ -23 +23,3 @@ A _route table_ contains a set of rules, called _routes_ , that determine where - * [Change a subnet route table](./WorkWithRouteTables.html) + * [Create a route table and routes](./create-vpc-route-table.html) + + * [Manage subnet route tables](./WorkWithRouteTables.html) @@ -27 +29 @@ A _route table_ contains a set of rules, called _routes_ , that determine where - * [Control traffic entering your VPC with a gateway route table](./associate-route-table-gateway.html) + * [Associate a route table with a gateway](./associate-route-table-gateway.html) @@ -31 +33 @@ A _route table_ contains a set of rules, called _routes_ , that determine where - * [Dynamic routing in your VPC using VPC Route Server](./dynamic-routing-route-server.html) + * [Dynamic routing in your VPC](./dynamic-routing-route-server.html) @@ -38,81 +39,0 @@ A _route table_ contains a set of rules, called _routes_ , that determine where -## Route priority - -In general, we direct traffic using the most specific route that matches the traffic. This is known as the longest prefix match. If your route table has overlapping or matching routes, additional rules apply. - -The following list shows a route priority summary with links to sections below with more detailed information and examples: - - 1. Longest prefix (for example, 10.10.2.15/32 has priority over 10.10.2.0/24) - - 2. Static routes (like VPC peering and internet gateway connections) - - 3. Prefix list routes - - 4. Propagated routes - - 1. Direct Connect BGP routes (dynamic routes) - - 2. VPN static routes - - 3. VPN BGP routes (dynamic routes) (like virtual private gateways) - - - - -### Longest prefix match - -Routes to IPv4 and IPv6 addresses or CIDR blocks are independent of each other. We use the most specific route that matches either IPv4 traffic or IPv6 traffic to determine how to route the traffic. - -The following example subnet route table has a route for IPv4 internet traffic (`0.0.0.0/0`) that points to an internet gateway, and a route for `172.31.0.0/16` IPv4 traffic that points to a peering connection (`pcx-11223344556677889`). Any traffic from the subnet that's destined for the `172.31.0.0/16` IP address range uses the peering connection, because this route is more specific than the route for internet gateway. Any traffic destined for a target within the VPC (`10.0.0.0/16`) is covered by the `local` route, and therefore is routed within the VPC. All other traffic from the subnet uses the internet gateway. - -Destination | Target ----|--- -10.0.0.0/16 | local -172.31.0.0/16 | pcx-11223344556677889 -0.0.0.0/0 | igw-12345678901234567 - -### Route priority for static and dynamically propagated routes - -If you've attached a virtual private gateway to your VPC and enabled route propagation on your subnet route table, routes representing your Site-to-Site VPN connection automatically appear as propagated routes in your route table. - -If the destination of a propagated route is identical to the destination of a static route, the static route takes priority. The following resources use static routes: - - * internet gateway - - * NAT gateway - - * Network interface - - * Instance ID - - * Gateway VPC endpoint - - * Transit gateway - - * VPC peering connection - - * Gateway Load Balancer endpoint - - - - -For more information, see [Route tables and VPN route priority](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNRoutingTypes.html#vpn-route-priority) in the _AWS Site-to-Site VPN User Guide_. - -The following example route table has a static route to an internet gateway and a propagated route to a virtual private gateway. Both routes have a destination of `172.31.0.0/24`. Because a static route to an internet gateway takes priority, all traffic destined for `172.31.0.0/24` is routed to the internet gateway. - -Destination | Target | Propagated ----|---|--- -10.0.0.0/16 | local | No -172.31.0.0/24 | vgw-11223344556677889 | Yes -172.31.0.0/24 | igw-12345678901234567 | No - -### Route priority for prefix lists - -If your route table references a prefix list, the following rules apply: - - * If your route table contains a propagated route that matches a route that references a prefix list, the route that references the prefix list takes priority. Please note that for routes that overlap, more specific routes always take priority irrespective of whether they are propagated routes, static routes, or routes that reference prefix lists. - - * If your route table references multiple prefix lists that have overlapping CIDR blocks to different targets, we randomly choose which route takes priority. Thereafter, the same route always takes priority. - - - -