AWS vpc-lattice high security documentation change
Summary
Updated DNS configuration guidance to recommend alias records over CNAME for Route 53, removed detailed SSL/TLS certificate requirements, and restructured procedural steps.
Security assessment
The removal of explicit guidance about requiring an SSL/TLS certificate for HTTPS configurations could lead to users inadvertently exposing services over unencrypted HTTP. This omission removes critical security documentation, increasing the risk of insecure deployments. However, the DNS changes promoting alias records (which support zone apex routing) improve reliability but do not directly address a security vulnerability.
Diff
diff --git a/vpc-lattice/latest/ug/service-custom-domain-name.md b/vpc-lattice/latest/ug/service-custom-domain-name.md index 55a607b00..38d03c43a 100644 --- a//vpc-lattice/latest/ug/service-custom-domain-name.md +++ b//vpc-lattice/latest/ug/service-custom-domain-name.md @@ -14 +14 @@ When you create a new service, VPC Lattice generates a unique Fully Qualified Do -However, the domain names that VPC Lattice provides are not easy for your users to remember. Custom domain names are simpler and more intuitive URLs that you can provide to your users. If you'd prefer to use a custom domain name for your service, such as `www.parking.example.com` instead of the VPC Lattice generated DNS name, you can configure it when you create a VPC Lattice service. When a client makes a request using your custom domain name, the DNS server resolves it to the VPC Lattice generated domain name. However, this happens only if you map your custom domain name to the VPC Lattice generated domain name with a CNAME record to route queries to your service. For more information, see Associate a custom domain name with your service. +However, the domain names that VPC Lattice provides are not easy for your users to remember. Custom domain names are simpler and more intuitive URLs that you can provide to your users. If you'd prefer to use a custom domain name for your service, such as `www.parking.example.com` instead of the VPC Lattice generated DNS name, you can configure it when you create a VPC Lattice service. When a client makes a request using your custom domain name, the DNS server resolves it to the VPC Lattice generated domain name. @@ -36 +36,6 @@ However, the domain names that VPC Lattice provides are not easy for your users -###### To configure a custom domain name for your service using the AWS Management Console +The following procedure shows how to configure a custom domain name for your service. + +AWS Management Console + + +###### To configure a custom domain name for your service @@ -55 +60,4 @@ However, the domain names that VPC Lattice provides are not easy for your users -###### To configure a custom domain name for your service using the AWS CLI +AWS CLI + + +###### To configure a custom domain name for your service @@ -64,2 +71,0 @@ In the above command, for `--name`, enter a name for your service. For `--custom -If you don’t have your own SSL/TLS certificate in AWS Certificate Manager (ACM), you can create or import one before setting up a custom domain name. However, the certificate is required only if you want to serve HTTPS requests using your custom domain name. For more information, see [Bring Your Own Certificate (BYOC) for VPC Lattice](./service-byoc.html). - @@ -77,25 +83 @@ First, if you haven't already done so, register your custom domain name. The Int -Next, use your DNS service, such as your domain registrar, to create a CNAME record to route queries to your service. For more information, see the documentation for your DNS service. Alternatively, you can use Route 53 as your DNS service. - -If you're using Route 53, you must first create a _hosted zone_ , which contains information about how to route traffic on the internet for your domain. After you create the private or public hosted zone, create a CNAME record such that your custom domain name, for example `parking.example.com`, is mapped to the VPC Lattice auto-generated domain name, for example, `my-service-02031c045478f6ddf1.7d67968.vpc-lattice-svcs.us-west-2.on.aws`. Without this mapping, your custom domain name won't work in VPC Lattice. For more information, see [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html) in the _Amazon Route 53 Developer Guide_. Additionally, you can refer to the steps below to create a hosted zone and a CNAME record to map your custom domain name to the VPC Lattice endpoint. - -###### To create a private or public hosted zone with a CNAME record using Amazon Route 53 console - - 1. Open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). - - 2. In the navigation pane, choose **Hosted zones** and then **Create hosted zone**. - - 3. For **Domain name** , choose the name of the hosted zone that you want to use to route traffic to your VPC Lattice service. For example, If your custom domain name is `parking.example.com` (http://parking.example.com/), then the domain name for your hosted zone will be `example.com` (http://example.com/), also known as the apex domain name. You can then create a CNAME record for this hosted zone to route traffic to your VPC Lattice service. Note: You can't change the name of a hosted zone after you create it. - - 4. For **Type** , choose **Private Hosted Zone** or **Public Hosted Zone** as required. - - 5. Choose your **Region** and select the **VPC ID** for a VPC that you want to associate with this hosted zone. - - 6. Add tags if necessary, and choose **Create hosted zone**. After creation, your hosted zone is listed under **Hosted Zones**. - - 7. To create a CNAME record in the hosted zone that you just created, select the hosted zone, then select **Create record**. - - 8. Specify the following values under **Create record** : - - 1. For **Record name** , enter the name that you want to use as your custom domain name. If you want to use `parking.example.com` (http://parking.example.com/) as your custom domain name, enter `parking`. This means that you would enter the subdomain name `parking` but without the hosted zone domain name `example.com` (http://example.com/). - - 2. For **Record type** , choose **CNAME**. +Next, use your DNS service, such as your domain registrar, to create a record to route queries to your service. For more information, see the documentation for your DNS service. Alternatively, you can use Route 53 as your DNS service. @@ -103 +85 @@ If you're using Route 53, you must first create a _hosted zone_ , which contains - 3. Keep **Alias** turned off. +If you're using Route 53, you can use an alias record or a CNAME record to route queries to your service. We recommend that you use an alias record as you can create an alias record at the top node of a DNS namespace, also known as the zone apex. @@ -105 +87 @@ If you're using Route 53, you must first create a _hosted zone_ , which contains - 4. For **Value** , enter the VPC Lattice generated the domain name for your service (for example, `my-service-02031c045478f6ddf1.7d67968.vpc-lattice-svcs.us-west-2.on.aws`). You will find this auto-generated domain name in the VPC Lattice console on your service page. If using the AWS CLI, the output of the `create-service` or `list-services` commands will return this auto-generated domain name. +If you're using Route 53, you must first create a _hosted zone_ , which contains information about how to route traffic on the internet for your domain. After you create the private or public hosted zone, create a record such that your custom domain name, for example `parking.example.com`, is mapped to the VPC Lattice auto-generated domain name, for example, `my-service-02031c045478f6ddf1.7d67968.vpc-lattice-svcs.us-west-2.on.aws`. Without this mapping, your custom domain name won't work in VPC Lattice. @@ -107 +89 @@ If you're using Route 53, you must first create a _hosted zone_ , which contains - 5. For **TTL (seconds)** , accept the default value of **300**. +The following procedures show how to create a private or public hosted zone using Route 53 @@ -109 +91 @@ If you're using Route 53, you must first create a _hosted zone_ , which contains - 6. For **Routing policy** , choose the applicable routing policy. For more information, see [Choosing a routing policy](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html) in the _Amazon Route 53 Developer Guide_. +AWS Management Console @@ -111 +92,0 @@ If you're using Route 53, you must first create a _hosted zone_ , which contains - 9. Choose **Create records**. @@ -113 +94 @@ If you're using Route 53, you must first create a _hosted zone_ , which contains -Changes generally propagate to all Route 53 servers within 60 seconds. When propagation is done, you'll be able to route traffic to your service by using the custom domain name. +To create an alias record to route queries to your service using Route 53, see [Routing traffic to Amazon VPC Lattice service domain endpoint](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-vpc-lattice-service.html). @@ -114,0 +96 @@ Changes generally propagate to all Route 53 servers within 60 seconds. When prop +Use the VPC Lattice generated domain name for your service, for instance `my-service-02031c045478f6ddf1.7d67968.vpc-lattice-svcs.us-west-2.on.aws` for the **Value**. You can find this auto-generated domain name in the VPC Lattice console on your service page. @@ -115,0 +98 @@ Changes generally propagate to all Route 53 servers within 60 seconds. When prop +AWS CLI @@ -118 +101 @@ Changes generally propagate to all Route 53 servers within 60 seconds. When prop -###### To create an alias record in your hosted zone using the AWS CLI +###### To create an alias record in your hosted zone