AWS vpn medium security documentation change
Summary
Added IPv6 support documentation, pre-shared key storage options (Standard/Secrets Manager), tunnel logging/lifecycle controls, and CLI examples for IPv6 VPN configurations
Security assessment
The change introduces security documentation for storing pre-shared keys in AWS Secrets Manager (security best practice) and adds tunnel activity logging capabilities. These are explicit security controls. The note about certificate-based authentication also reinforces security practices.
Diff
diff --git a/vpn/latest/s2svpn/create-tgw-vpn-attachment.md b/vpn/latest/s2svpn/create-tgw-vpn-attachment.md index 13a29b696..0d2adeb15 100644 --- a//vpn/latest/s2svpn/create-tgw-vpn-attachment.md +++ b//vpn/latest/s2svpn/create-tgw-vpn-attachment.md @@ -4,0 +5,2 @@ +Creating a VPN attachment using the CLIViewing IPv6 addresses for your VPN connection + @@ -8,0 +11,2 @@ To create a VPN attachment on a transit gateway, you must specify the transit ga +Transit gateway VPN attachments support both IPv4 or IPv6. For more information on using either of these protocols for a transit gateway VPN attachment, see [IPv4 and IPv6 traffic in AWS Site-to-Site VPN](./ipv4-ipv6.html). + @@ -23 +27,5 @@ To create a VPN attachment on a transit gateway, you must specify the transit ga - * To use an existing customer gateway, choose **Existing** , and then choose the customer gateway. + * To use an existing customer gateway, choose **Existing** , and then choose the **Customer gateway ID**. + + * To create a new customer gateway, choose **New**. + + 1. For the **IP address** , enter a static **IPv4** or **IPv6** address. @@ -25 +33 @@ To create a VPN attachment on a transit gateway, you must specify the transit ga -If your customer gateway is behind a network address translation (NAT) device that's enabled for NAT traversal (NAT-T), use the public IP address of your NAT device, and adjust your firewall rules to unblock UDP port 4500. + 2. (Optional) For **Certificate ARN** , choose the ARN of your private certificate (if using certificate-based authentication). @@ -27 +35 @@ If your customer gateway is behind a network address translation (NAT) device th - * To create a customer gateway, choose **New**. For **IP Address** , enter a static public IP address. For **Certificate ARN** , choose the ARN of your private certificate (if using certificate-based authentication). For **BGP ASN** , enter the Border Gateway Protocol (BGP) Autonomous System Number (ASN) of your customer gateway. For more information, see [Customer gateway options](./cgw-options.html). + 3. For **BGP ASN** , enter the Border Gateway Protocol (BGP) Autonomous System Number (ASN) of your customer gateway. For more information, see [Customer gateway options](./cgw-options.html). @@ -29 +37 @@ If your customer gateway is behind a network address translation (NAT) device th - 7. For **Routing options** , choose **Dynamic** or **Static**. + 7. For **Routing options** , choose **Dynamic (requires BGP)** or **Static**. @@ -31 +39 @@ If your customer gateway is behind a network address translation (NAT) device th - 8. For **Tunnel inside IP version** , specify whether the VPN tunnels support IPv4 or IPv6 traffic. IPv6 traffic is only supported for VPN connections on a transit gateway. + 8. For **Pre-shared key storage** choose either **Standard** or **Secrets Manager**. The default selection is **Standard**. For more information about using AWS Secrets Manager, see [Security](./security.html). @@ -33 +41,3 @@ If your customer gateway is behind a network address translation (NAT) device th - 9. (Optional) For **Enable acceleration** , select the check box to enable acceleration. For more information, see [Accelerated VPN connections](./accelerated-vpn.html). + 9. For **Tunnel inside IP version** , choose **IPv4** or **IPv6**. + + 10. (Optional) For **Enable acceleration** , choose the check box to enable acceleration. For more information, see [Accelerated VPN connections](./accelerated-vpn.html). @@ -37 +47,7 @@ If you enable acceleration, we create two accelerators that are used by your VPN - 10. (Optional) For **Local IPv4 network CIDR** , specify the IPv4 CIDR range on the customer gateway (on-premises) side that is allowed to communicate over the VPN tunnels. The default is `0.0.0.0/0`. + 11. (Optional) Depending on which tunnel inside IP version you've chosen, do one of the following: + + * IPv4 — For **Local IPv4 network CIDR** , specify the IPv4 CIDR range on the customer gateway (on-premises) side that is allowed to communicate over the VPN tunnels. For **Remote IPv4 network CIDR** , choose the CIDR range on the AWS side that is allowed to communicate over VPN tunnels. The default value for both fields is `0.0.0.0/0`. + + * IPv6 — For **Local IPv6 network CIDR** , specify the IPv6 CIDR range on the customer gateway (on-premises) side that is allowed to communicate over the VPN tunnels. For **Remote IPv6 network CIDR** , choose the CIDR range on the AWS side that is allowed to communicate over VPN tunnels. The default value for both fields is `::/0` + + 12. For **Outside IP address type** , choose one of the following options: @@ -39 +55 @@ If you enable acceleration, we create two accelerators that are used by your VPN -For **Remote IPv4 network CIDR** , specify the IPv4 CIDR range on the AWS side that is allowed to communicate over the VPN tunnels. The default is `0.0.0.0/0`. + * **Public IPv4** \- (Default) Use IPv4 addresses for the outer tunnel IPs. @@ -41 +57 @@ For **Remote IPv4 network CIDR** , specify the IPv4 CIDR range on the AWS side t -If you specified **IPv6** for **Tunnel inside IP version** , then specify the IPv6 CIDR ranges on the customer gateway side and AWS side that are allowed to communicate over the VPN tunnels. The default for both ranges is `::/0`. + * **Private IPv4** \- Use a private IPv4 address for use within private networks. @@ -43 +59,7 @@ If you specified **IPv6** for **Tunnel inside IP version** , then specify the IP - 11. (Optional) For **Tunnel options** , you can specify the following information for each tunnel: + * **IPv6** \- Use IPv6 addresses for the outer tunnel IPs. This option requires that your customer gateway device supports IPv6 addressing. + +###### Note + +If you select **IPv6** for the outside IP address type, you must create a customer gateway with an IPv6 address + + 13. (Optional) For **Tunnel 1 options** , you can specify the following information for each tunnel: @@ -53 +75,3 @@ If you specified **IPv6** for **Tunnel inside IP version** , then specify the IP - 12. Choose **Create VPN connection**. + * (Optional) Choose **Enable** for the **Tunnel activity log** to capture log messages for IPsec activity and DPD protocol messages. + + * (Optional) Choose **Turn on** for **Tunnel endpoint lifecycle** to control the schedule for endpoint replacements. For more information about tunnel endpoint lifecycle, see [Tunnel endpoint lifecycle](./tunnel-endpoint-lifecycle.html). @@ -54,0 +79 @@ If you specified **IPv6** for **Tunnel inside IP version** , then specify the IP + 14. (Optional) Choose **Tunnel 2 options** and follow the previous steps to set up a second tunnel. @@ -55,0 +81 @@ If you specified **IPv6** for **Tunnel inside IP version** , then specify the IP + 15. Choose **Create VPN connection**. @@ -58 +84,3 @@ If you specified **IPv6** for **Tunnel inside IP version** , then specify the IP -###### To create a VPN attachment using the AWS CLI + + +## Creating a VPN attachment using the CLI @@ -61,0 +90,40 @@ Use the [create-vpn-connection](https://awscli.amazonaws.com/v2/documentation/ap +Example for creating a VPN connection with IPv6 outer tunnel IPs and IPv6 inner tunnel IPs: + + + aws ec2 create-vpn-connection --type ipsec.1 --transit-gateway-id tgw-12312312312312312 --customer-gateway-id cgw-001122334455aabbc --options OutsideIPAddressType=Ipv6,TunnelInsideIpVersion=ipv6,TunnelOptions=[{StartupAction=start},{StartupAction=start}] + +Example for creating a VPN connection with IPv6 outer tunnel IPs and IPv4 inner tunnel IPs: + + + aws ec2 create-vpn-connection --type ipsec.1 --transit-gateway-id tgw-12312312312312312 --customer-gateway-id cgw-001122334455aabbc --options OutsideIPAddressType=Ipv6,TunnelInsideIpVersion=ipv4,TunnelOptions=[{StartupAction=start},{StartupAction=start}] + +## Viewing IPv6 addresses for your VPN connection + +After creating a VPN connection with IPv6 outer tunnel IPs, you can view the assigned IPv6 addresses using the `describe-vpn-connections` CLI command: + + + aws ec2 describe-vpn-connections --vpn-connection-ids vpn-12345678901234567 + +In the response, look for the `OutsideIpAddress` field in the `TunnelOptions` section. For IPv6 VPN connections, this field will contain the IPv6 addresses assigned to the AWS side of the VPN tunnels. + +Example response excerpt: + + + "Options": { + "OutsideIPAddressType": "Ipv6", + "TunnelInsideIpVersion": "ipv6", + "TunnelOptions": [ + { + "OutsideIpAddress": "2600:1f14:2dcf:d556:c3db:e57f:2414:2d9a", + "TunnelInsideCidr": "2001:db8:1001:b110::/64", + ... + }, + { + "OutsideIpAddress": "2600:1f14:2dcf:d57d:6318:60af:37c5:7ce1", + "TunnelInsideCidr": "2001:db8:1001:b111::/64", + ... + } + ] + } + +