AWS vpc documentation change
Summary
Added documentation for network function attachments including AWS Network Firewall integration, detailing automated security infrastructure and traffic inspection capabilities
Security assessment
The change introduces documentation for a security feature (Network Firewall integration) that simplifies traffic inspection and policy enforcement. While it enhances security capabilities, there's no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/vpc/latest/tgw/how-transit-gateways-work.md b/vpc/latest/tgw/how-transit-gateways-work.md index ae0ba3724..4a9879ac8 100644 --- a//vpc/latest/tgw/how-transit-gateways-work.md +++ b//vpc/latest/tgw/how-transit-gateways-work.md @@ -5 +5 @@ -Example architecture diagramResource attachmentsEqual Cost Multipath routing Availability ZonesRoutingExample transit gateway scenarios +Example architecture diagramResource attachmentsEqual Cost Multipath routing Availability ZonesRoutingNetwork function attachmentsExample transit gateway scenarios @@ -22,0 +23,2 @@ In AWS Transit Gateway a transit gateway acts as a Regional virtual router for t + * Network function attachments + @@ -229,0 +232,43 @@ Destination | Attachment (Target) | Resource type | Route type | Priority +## Network function attachments + +A network function attachment is a resource that connects a network security function — for example, an AWS Network Firewall attachment — directly to your transit gateway. It eliminates the need to manually create and manage inspection VPCs. + +With a network function attachment: + + * AWS automatically creates and manages the underlying infrastructure + + * Traffic can be inspected as it flows through your transit gateway + + * Security policies are applied consistently across your network + + + + + * You can direct traffic through the firewall using simple routing rules + + * The attachment works across multiple Availability Zones for high availability + + + + +This integration simplifies network security by allowing you to attach firewalls directly to your transit gateway rather than creating complex routing configurations and managing separate endpoints through separate VPCs. + +### AWS Network Firewall integration + +AWS Network Firewall integration allows you to connect a firewall in the form of a group of Gateway Load Balancer Endpoints, one per Availability Zone, in a service-managed buffer VPC. A Network Firewall attachment is created with appliance mode automatically enabled. This eliminates the need to explicitly manage inspection VPCs. + +With Network Firewall integration, you no longer need to create and manage inspection VPCs for your Network Firewall deployments. Instead of selecting a VPC and subnets when creating your firewall, you directly select the Transit Gateway, and AWS automatically provisions and manages all the necessary resources behind the scenes. You'll see a new transit gateway network function attachment rather than an individual firewall endpoint. + +For cross-account scenarios, the Transit Gateway can be RAM-shared from the Transit Gateway owner to the Network Firewall owner account, allowing either account to manage the firewall attachment. Once your firewall and attachment are ready, you can simply modify your Transit Gateway route tables to send traffic to the attachment for inspection. + +###### Note + + * Transit Gateway supports only static routing on Network Firewall attachments. + + * Third-party firewalls are not supported. + + + + +For more information about firewalls and attachments see [Transit gateway network function attachments](./tgw-nf-fw.html). +