AWS vpc documentation change
Summary
Updated appliance mode documentation with corrected Availability Zone examples, revised traffic routing scenarios, and added note about enabling route propagation
Security assessment
Changes clarify traffic routing behavior and configuration requirements but do not address security vulnerabilities. The added route propagation note relates to operational correctness rather than security.
Diff
diff --git a/vpc/latest/tgw/tgw-vpc-attachments.md b/vpc/latest/tgw/tgw-vpc-attachments.md index aac5cb65f..a65c28b2c 100644 --- a//vpc/latest/tgw/tgw-vpc-attachments.md +++ b//vpc/latest/tgw/tgw-vpc-attachments.md @@ -88 +88 @@ If you plan to configure a stateful network appliance in your VPC, you can enabl -Appliance mode in AWS Transit Gateway optimizes traffic routing by considering the source and destination Availability Zones when determining the path through an appliance mode VPC. This approach enhances efficiency and reduces latency. The following are example scenarios. +Appliance mode in AWS Transit Gateway optimizes traffic routing by considering the source and destination Availability Zones when determining the path through an appliance mode VPC. This approach enhances efficiency and reduces latency. The behavior varies depending on the specific configuration and traffic patterns. The following are example scenarios. @@ -90 +90 @@ Appliance mode in AWS Transit Gateway optimizes traffic routing by considering t -### Scenario 1: Intra-Availability Zone traffic routing via an appliance VPC +### Scenario 1: Intra-Availability Zone Traffic Routing via Appliance VPC @@ -92 +92 @@ Appliance mode in AWS Transit Gateway optimizes traffic routing by considering t -When traffic flows from a source Availability Zone in us-east-1a to a destination Availability Zone in us-east-1b, with appliance mode attachments in both us-east-1a and us-east-1b, AWS Transit Gateway does the following: +When traffic flows from source Availability Zone us-east-1a to destination Availability Zone us-east-1a, with Appliance Mode VPC attachments in both us-east-1a and us-east-1b, Transit Gateway selects a network interface from us-east-1a within the appliance VPC. This Availability Zone is maintained for the entire duration of the traffic flow between source and destination. @@ -94 +94 @@ When traffic flows from a source Availability Zone in us-east-1a to a destinatio - 1. For ingress traffic (from source to appliance VPC), AWS Transit Gateway chooses a network interface from us-east-1a within the appliance VPC. +### Scenario 2: Inter-Availability Zone Traffic Routing via Appliance VPC @@ -96,10 +96 @@ When traffic flows from a source Availability Zone in us-east-1a to a destinatio - 2. For egress traffic (from appliance VPC to destination), AWS Transit Gateway chooses a network interface from us-east-1b within the appliance VPC. - - - - -The Availability Zone is not maintained for the entire duration of the traffic flow between source and destination. Instead, Transit Gateway optimizes the path by using network interfaces in both the source and destination Availability Zones, minimizing cross-Availability Zone traffic and associated costs while maintaining the traffic flow through the appliance VPC. - -### Scenario 2: Inter-Availability Zone traffic routing via an appliance VPC - -For traffic flowing from a source Availability Zone in us-east-1a to a destination Availability Zone in us-east-1b, with appliance mode VPC attachments in both us-east-1a and us-east-1b, AWS Transit Gateway uses a flow hash algorithm to select either us-east-1a or us-east-1b in the appliance VPC. The chosen Availability Zone is used consistently for the lifetime of the flow. +For traffic flowing from source Availability Zone us-east-1a to destination Availability Zone us-east-1b, with Appliance Mode VPC attachments in both us-east-1a and us-east-1b, Transit Gateway uses a flow hash algorithm to select either us-east-1a or us-east-1b in the appliance VPC. The chosen Availability Zone is used consistently for the lifetime of the flow. @@ -109 +100 @@ For traffic flowing from a source Availability Zone in us-east-1a to a destinati -When traffic originates from source Availability Zone in us-east-1a to a destination without Availability Zone information — for example, internet-bound traffic — with appliance mode VPC attachments in both us-east-1a and us-east-1b, AWS Transit Gateway chooses a network interface from us-east-1a within the appliance VPC. +When traffic originates from source Availability Zone us-east-1a to a destination without Availability Zone information (e.g., internet-bound traffic), with Appliance Mode VPC attachments in both us-east-1a and us-east-1b, Transit Gateway selects a network interface from us-east-1a within the appliance VPC. @@ -111 +102 @@ When traffic originates from source Availability Zone in us-east-1a to a destina -### Scenario 4: Routing traffic through an Availability Zone distinct from either the source or destination +### Scenario 4: Routing traffic through an appliance VPC in an Availability Zone distinct from either the source or destination @@ -113 +104 @@ When traffic originates from source Availability Zone in us-east-1a to a destina -When traffic flows from a source Availability Zone in us-east-1a to a destination Availability Zone us-east-1b with appliance mode VPC attachments in different Availability Zones from either the source or destination — for example, the appliance mode VPCs are in us-east-1c and us-east-1d — AWS Transit Gateway uses a flow hash algorithm to select either us-east-1c or us-east-1d in the appliance VPC. The chosen Availability Zone is used consistently for the lifetime of the flow. +When traffic flows from source Availability Zone us-east-1a to destination Availability Zone us-east-1b, with Appliance Mode VPC attachments in different Availability Zone example us-east-1c and us-east-1d, Transit Gateway uses a flow hash algorithm to select either us-east-1c or us-east-1d in the appliance VPC. The chosen Availability Zone is used consistently for the lifetime of the flow. @@ -117 +108 @@ When traffic flows from a source Availability Zone in us-east-1a to a destinatio -Appliance mode is only supported for VPC attachments. +Appliance mode is only supported for VPC attachments. Ensure that route propagation is enabled for a route table associated with an appliance VPC attachment.