AWS network-manager documentation change
Summary
Restructured traffic routing scenarios with Appliance Mode VPC attachments, clarifying Availability Zone selection logic and flow consistency
Security assessment
Changes improve documentation accuracy about network path selection but contain no evidence of addressing security vulnerabilities or describing security-specific features. Focus is on routing behavior optimization.
Diff
diff --git a/network-manager/latest/cloudwan/cloudwan-vpc-attachment.md b/network-manager/latest/cloudwan/cloudwan-vpc-attachment.md index 8e328c843..a9d0b83b2 100644 --- a//network-manager/latest/cloudwan/cloudwan-vpc-attachment.md +++ b//network-manager/latest/cloudwan/cloudwan-vpc-attachment.md @@ -21 +21 @@ Appliance mode in Cloud WAN optimizes traffic routing by considering the source -### Scenario 1: Intra-Availability Zone traffic routing via an appliance VPC +### Scenario 1: Intra-Availability Zone Traffic Routing via Appliance VPC @@ -23 +23 @@ Appliance mode in Cloud WAN optimizes traffic routing by considering the source -When traffic flows from a source Availability Zone in us-east-1a to a destination Availability Zone in us-east-1b, with appliance mode attachments in both us-east-1a and us-east-1b, Cloud WAN does the following: +When traffic flows from source Availability Zone us-east-1a to destination Availability Zone us-east-1a, with Appliance Mode VPC attachments in both us-east-1a and us-east-1b, Cloud WAN selects a network interface from us-east-1a within the appliance VPC. This Availability Zone is maintained for the entire duration of the traffic flow between source and destination. @@ -25 +25 @@ When traffic flows from a source Availability Zone in us-east-1a to a destinatio - 1. For ingress traffic (from source to appliance VPC), Cloud WAN chooses a network interface from us-east-1a within the appliance VPC. +### Scenario 2: Inter-Availability Zone Traffic Routing via Appliance VPC @@ -27,10 +27 @@ When traffic flows from a source Availability Zone in us-east-1a to a destinatio - 2. For egress traffic (from appliance VPC to destination), Cloud WAN chooses a network interface from us-east-1b within the appliance VPC. - - - - -The Availability Zone is not maintained for the entire duration of the traffic flow between source and destination. Instead, Cloud WAN optimizes the path by using network interfaces in both the source and destination Availability Zones, minimizing cross-Availability Zone traffic and associated costs while maintaining the traffic flow through the appliance VPC. - -### Scenario 2: Inter-Availability Zone traffic routing via an appliance VPC - -For traffic flowing from a source Availability Zone in us-east-1a to a destination Availability Zone in us-east-1b, with appliance mode VPC attachments in both us-east-1a and us-east-1b, Cloud WAN uses a flow hash algorithm to select either us-east-1a or us-east-1b in the appliance VPC. The chosen Availability Zone is used consistently for the lifetime of the flow. +For traffic flowing from source Availability Zone us-east-1a to destination Availability Zone us-east-1b, with Appliance Mode VPC attachments in both us-east-1a and us-east-1b, Cloud WAN uses a flow hash algorithm to select either us-east-1a or us-east-1b in the appliance VPC. The chosen Availability Zone is used consistently for the lifetime of the flow. @@ -40 +31 @@ For traffic flowing from a source Availability Zone in us-east-1a to a destinati -When traffic originates from source Availability Zone in us-east-1a to a destination without Availability Zone information — for example, internet-bound traffic — with appliance mode VPC attachments in both us-east-1a and us-east-1b, Cloud WAN chooses a network interface from us-east-1a within the appliance VPC. +When traffic originates from source Availability Zone us-east-1a to a destination without Availability Zone information (e.g., internet-bound traffic), with Appliance Mode VPC attachments in both us-east-1a and us-east-1b, Cloud WAN selects a network interface from us-east-1a within the appliance VPC. @@ -42 +33 @@ When traffic originates from source Availability Zone in us-east-1a to a destina -### Scenario 4: Routing traffic through an Availability Zone distinct from either the source or destination +### Scenario 4: Routing traffic through an appliance VPC in an Availability Zone distinct from either the source or destination @@ -44 +35 @@ When traffic originates from source Availability Zone in us-east-1a to a destina -When traffic flows from a source Availability Zone in us-east-1a to a destination Availability Zone us-east-1b with appliance mode VPC attachments in different Availability Zones from either the source or destination — for example, the appliance mode VPCs are in us-east-1c and us-east-1d — Cloud WAN uses a flow hash algorithm to select either us-east-1c or us-east-1d in the appliance VPC. The chosen Availability Zone is used consistently for the lifetime of the flow. +When traffic flows from source Availability Zone us-east-1a to destination Availability Zone us-east-1b, with Appliance Mode VPC attachments in different Availability Zone example us-east-1c and us-east-1d, Cloud WAN uses a flow hash algorithm to select either us-east-1c or us-east-1d in the appliance VPC. The chosen Availability Zone is used consistently for the lifetime of the flow.