AWS kms documentation change
Summary
1. Added 'IP stack' to networking issue list. 2. Added firewall guidance for port 443 over IPv4. 3. Specified IPv4 in port 443 communication.
Security assessment
Clarifies network configuration requirements (e.g., IPv4-only support, firewall rules for port 443) to ensure secure connectivity. While not fixing a specific vulnerability, it strengthens security documentation by emphasizing proper network controls.
Diff
diff --git a/kms/latest/developerguide/xks-troubleshooting.md b/kms/latest/developerguide/xks-troubleshooting.md index 5f459fbdc..b75706577 100644 --- a//kms/latest/developerguide/xks-troubleshooting.md +++ b//kms/latest/developerguide/xks-troubleshooting.md @@ -17 +17 @@ When diagnosing an issue with an external key store, first locate the cause. Thi - * Networking — It might be a problem with connectivity or networking, such as a problem with your proxy endpoint, port, or your private DNS name or domain. + * Networking — It might be a problem with connectivity or networking, such as a problem with your proxy endpoint, port, IP stack, or your private DNS name or domain. @@ -187,0 +188,2 @@ A private DNS domain can be verified only if it is the subdomain of a public dom + * Ensure that any firewalls between AWS KMS and the external key store proxy allow traffic to and from port 443 on the proxy. AWS KMS communicates on port 443 over IPv4. This value is not configurable. + @@ -330 +332 @@ This error might occur for the following reasons: - * There might be a network configuration error, such as a port error, on the network path between AWS KMS and the external key store proxy. AWS KMS communicates with the external key store proxy on port 443. This value is not configurable. + * There might be a network configuration error, such as a port error, on the network path between AWS KMS and the external key store proxy. AWS KMS communicates with the external key store proxy on port 443 over IPv4. This value is not configurable.