AWS network-firewall documentation change
Summary
Updated TLS inspection restrictions and troubleshooting links.
Security assessment
Clarifies TLS inspection limitations with VPC endpoints, preventing misconfigurations. Security feature documentation update with no direct vulnerability fix.
Diff
diff --git a/network-firewall/latest/developerguide/firewall-and-firewall-endpoints-considerations.md b/network-firewall/latest/developerguide/firewall-and-firewall-endpoints-considerations.md index 62f72e566..b4ac3c00f 100644 --- a//network-firewall/latest/developerguide/firewall-and-firewall-endpoints-considerations.md +++ b//network-firewall/latest/developerguide/firewall-and-firewall-endpoints-considerations.md @@ -72 +72 @@ These failures can occur if the AWS KMS key is revoked, disabled, or deleted. To -For more information on potential error scenarios and how to resolve them, see [Troubleshooting firewall endpoint failures in AWS Network Firewall](./firewall-troubleshooting-endpoint-failures.html) +For more information on potential error scenarios and how to resolve them, see [Troubleshooting firewall endpoint failures in AWS Network Firewall](./firewall-troubleshooting-endpoint-failures.html). @@ -99 +99 @@ For more information about unsharing firewalls, see [Unsharing a shared Network -TLS inspection: +###### Important @@ -101 +101 @@ TLS inspection: - * Is only supported through the primary VPC's endpoints and secondary endpoints if created in the same account as that of the firewall owner +TLS inspection is not supported for firewalls with VPC endpoint associations. @@ -103 +103 @@ TLS inspection: - * Cannot be used with VPC endpoint associations in other accounts + * A firewall policy that has TLS inspection enabled cannot be added to a firewall that has VPC endpoint associations. @@ -105 +105 @@ TLS inspection: - * Prevents creation of new VPC endpoint associations when enabled + * A VPC endpoint association cannot be created from a firewall that has a firewall policy with TLS inspection enabled. @@ -110 +110 @@ TLS inspection: -For details, see [Inspecting SSL/TLS traffic with TLS inspection configurations in AWS Network Firewall](./tls-inspection-configurations.html). +For details, see [Troubleshooting firewall endpoint failures in AWS Network Firewall](./firewall-troubleshooting-endpoint-failures.html) and [Inspecting SSL/TLS traffic with TLS inspection configurations in AWS Network Firewall](./tls-inspection-configurations.html). @@ -126 +126 @@ When managing multiple VPCs: -For more information on potential error scenarios and how to resolve them, see [Troubleshooting firewall endpoint failures in AWS Network Firewall](./firewall-troubleshooting-endpoint-failures.html) +For more information on potential error scenarios and how to resolve them, see [Troubleshooting firewall endpoint failures in AWS Network Firewall](./firewall-troubleshooting-endpoint-failures.html).