AWS vpc medium security documentation change
Summary
Updated list of AWS services supporting PrivateLink with numerous additions of FIPS endpoints and service entries. Modified example outputs and added documentation links.
Security assessment
Added multiple FIPS-compliant endpoints (e.g., 'rds-fips', 'eks-fips', 'securityhub-fips') which are specifically designed for compliance with US federal security standards. FIPS endpoints indicate enhanced cryptographic module requirements, directly relating to security controls.
Diff
diff --git a/vpc/latest/privatelink/aws-services-privatelink-support.md b/vpc/latest/privatelink/aws-services-privatelink-support.md index 821187735..d5c1ce1bd 100644 --- a//vpc/latest/privatelink/aws-services-privatelink-support.md +++ b//vpc/latest/privatelink/aws-services-privatelink-support.md @@ -15 +14,0 @@ AWS service | Service name -Access Analyzer | com.amazonaws.`region`.access-analyzer @@ -17,0 +17 @@ Access Analyzer | com.amazonaws.`region`.access-analyzer +com.amazonaws.`region`.apigateway @@ -33,0 +34 @@ com.amazonaws.`region`.appstream.streaming +com.amazonaws.`region`.rds-fips @@ -42,0 +44,4 @@ com.amazonaws.`region`.bedrock-agent-runtime +com.amazonaws.`region`.bedrock-data-automation +com.amazonaws.`region`.bedrock-data-automation-fips +com.amazonaws.`region`.bedrock-data-automation-runtime +com.amazonaws.`region`.bedrock-data-automation-runtime-fips @@ -49,0 +55 @@ com.amazonaws.`region`.tax +com.amazonaws.`region`.cleanrooms-fips @@ -89,0 +96 @@ com.amazonaws.`region`.codedeploy-commands-secure +com.amazonaws.`region`.codedeploy-fips @@ -110 +117,2 @@ com.amazonaws.`region`.controltower-fips -AWS Data Exports | com.amazonaws.`region`.bcm-data-exports +AWS Data Exports | aws.api.`region`.bcm-data-exports +com.amazonaws.`region`.bcm-pricing-calculator @@ -112,0 +121 @@ AWS Data Exports | com.amazonaws.`region`.bcm-data-exports +com.amazonaws.`region`.dlm-fips @@ -119,0 +129,2 @@ com.amazonaws.`region`.deadline.scheduling +AWS Direct Connect | com.amazonaws.`region`.directconnect +com.amazonaws.`region`.directconnect-fips @@ -121,0 +133 @@ com.amazonaws.`region`.ds-data +com.amazonaws.`region`.ds-data-fips @@ -138,0 +151,2 @@ com.amazonaws.`region`.eks-auth +com.amazonaws.`region`.eks-fips +com.amazonaws.`region`.eks-proxy @@ -144,0 +159,2 @@ com.amazonaws.`region`.elasticfilesystem-fips +Amazon Elastic VMware Service | com.amazonaws.`region`.evs +com.amazonaws.`region`.evs-fips @@ -148,0 +165 @@ AWS Elemental MediaConvert | com.amazonaws.`region`.mediaconvert +com.amazonaws.`region`.mediaconvert-fips @@ -149,0 +167 @@ AWS Elemental MediaConvert | com.amazonaws.`region`.mediaconvert +com.amazonaws.`region`.elasticmapreduce-fips @@ -152,0 +171 @@ com.amazonaws.`region`.emr-serverless-services.livy +com.amazonaws.`region`.emr-serverless.dashboard @@ -154,0 +174 @@ com.amazonaws.`region`.emr-serverless-services.livy +com.amazonaws.`region`.social-messaging-fips @@ -156,0 +177 @@ com.amazonaws.`region`.emr-serverless-services.livy +com.amazonaws.`region`.events-fips @@ -162,0 +184 @@ com.amazonaws.`region`.schemas +com.amazonaws.`region`.fis-fips @@ -164,0 +187,2 @@ com.amazonaws.`region`.finspace-api +AWS Firewall Manager | com.amazonaws.`region`.fms +com.amazonaws.`region`.fms-fips @@ -189,0 +214 @@ com.amazonaws.`region`.runtime-medical-imaging +com.amazonaws.`region`.analytics-omics-fips @@ -190,0 +216 @@ com.amazonaws.`region`.control-storage-omics +com.amazonaws.`region`.control-storage-omics-fips @@ -192,0 +219 @@ com.amazonaws.`region`.tags-omics +com.amazonaws.`region`.tags-omics-fips @@ -193,0 +221 @@ com.amazonaws.`region`.workflows-omics +com.amazonaws.`region`.workflows-omics-fips @@ -194,0 +223,2 @@ com.amazonaws.`region`.workflows-omics +IAM Access Analyzer | com.amazonaws.`region`.access-analyzer +com.amazonaws.`region`.access-analyzer-fips @@ -196,0 +227 @@ IAM Identity Center | com.amazonaws.`region`.identitystore +com.amazonaws.`region`.rolesanywhere-fips @@ -197,0 +229 @@ Amazon Inspector | com.amazonaws.`region`.inspector2 +com.amazonaws.`region`.inspector2-fips @@ -198,0 +231 @@ com.amazonaws.`region`.inspector-scan +com.amazonaws.`region`.inspector-scan-fips @@ -232,0 +266 @@ com.amazonaws.`region`.license-manager-user-subscriptions +com.amazonaws.`region`.license-manager-user-subscriptions-fips @@ -243,0 +278 @@ com.amazonaws.`region`.geo.metadata +com.amazonaws.`region`.macie2-fips @@ -265,0 +301 @@ com.amazonaws.`region`.memorydb-fips +com.amazonaws.`region`.mq-fips @@ -298,0 +335 @@ Amazon Q User Subscriptions | com.amazonaws.`region`.service.user-subscriptions +com.amazonaws.`region`.rds-fips @@ -314,0 +352,3 @@ com.amazonaws.`region`.streaming-rekognition-fips +com.amazonaws.`region`.ram-fips +[AWS Resource Explorer](https://docs.aws.amazon.com/resource-explorer/latest/userguide/vpc-interface-endpoints.html) | com.amazonaws.`region`.resource-explorer-2 +com.amazonaws.`region`.resource-explorer-2-fips @@ -330,0 +371 @@ com.amazonaws.`region`.sagemaker.featurestore-runtime +com.amazonaws.`region`.sagemaker.featurestore-runtime-fips @@ -334 +375 @@ com.amazonaws.`region`.sagemaker.runtime-fips -Savings Plans | com.amazonaws.`region`.savingsplans +Savings Plans | com.amazonaws.savingsplans @@ -336,0 +378 @@ Savings Plans | com.amazonaws.`region`.savingsplans +com.amazonaws.`region`.securityhub-fips @@ -343,0 +386 @@ com.amazonaws.`region`.servicecatalog-appregistry +Service Quotas | com.amazonaws.`region`.servicequotas @@ -346,0 +390,2 @@ com.amazonaws.`region`.mail-manager-fips +com.amazonaws.`region`.mail-manager-smtp.auth.fips +com.amazonaws.`region`.mail-manager-smtp.open.fips @@ -384,0 +430,2 @@ com.amazonaws.`region`.verifiedpermissions-fips +AWS WAFV2 | com.amazonaws.`region`.wafv2 +com.amazonaws.`region`.wafv2-fips @@ -386,0 +434 @@ Amazon WorkMail | com.amazonaws.`region`.workmail +com.amazonaws.`region`.workmailmessageflow @@ -388 +436 @@ Amazon WorkMail | com.amazonaws.`region`.workmail -Amazon Workspaces Secure Browser | com.amazonaws.`region`.workspaces-web +[Amazon WorkSpaces Secure Browser](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/private-link.html) | com.amazonaws.`region`.workspaces-web @@ -389,0 +438 @@ com.amazonaws.`region`.workspaces-web-fips +[WorkSpaces streaming](https://docs.aws.amazon.com/workspaces/latest/adminguide/creating-streaming-vpc-endpoints.html) | com.amazonaws.`region`.highlander @@ -405 +454 @@ The following example displays the AWS services that support interface endpoints -The following is example output: +The following is example output. The complete output is not shown. @@ -408,0 +458,4 @@ The following is example output: + "api.aws.us-east-1.cassandra-streams", + "aws.api.us-east-1.bcm-data-exports", + "aws.api.us-east-1.emr-service-cell01", + "aws.api.us-east-1.freetier", @@ -410,5 +463 @@ The following is example output: - "aws.sagemaker.us-east-1.notebook", - "aws.sagemaker.us-east-1.studio", - "com.amazonaws.s3-global.accesspoint", - "com.amazonaws.us-east-1.access-analyzer", - "com.amazonaws.us-east-1.account", + "aws.api.us-east-1.qbusiness", @@ -415,0 +465 @@ The following is example output: + "com.amazonaws.us-east-1.xray" @@ -458,2 +508,10 @@ The following is example output. `VpcEndpointPolicySupported` indicates whether - } - ], + }, + { + "PrivateDnsName": "monitoring.us-east-1.api.aws" + }, + { + "PrivateDnsName": "monitoring-fips.us-east-1.amazonaws.com" + }, + { + "PrivateDnsName": "monitoring-fips.us-east-1.api.aws" + } ], @@ -465,0 +524 @@ The following is example output. `VpcEndpointPolicySupported` indicates whether + "ipv6", @@ -501 +560 @@ The following example lists the AWS services that support endpoint policies in t -The following is example output. +The following is example output. The complete output is not shown. @@ -504,0 +564,4 @@ The following is example output. + "api.aws.us-east-1.cassandra-streams", + "aws.api.us-east-1.bcm-data-exports", + "aws.api.us-east-1.emr-service-cell01", + "aws.api.us-east-1.freetier", @@ -506,5 +568,0 @@ The following is example output. - "aws.sagemaker.us-east-1.notebook", - "aws.sagemaker.us-east-1.studio", - "com.amazonaws.s3-global.accesspoint", - "com.amazonaws.us-east-1.access-analyzer", - "com.amazonaws.us-east-1.account", @@ -511,0 +570 @@ The following is example output. + "com.amazonaws.us-east-1.xray" @@ -522 +581 @@ The following example lists the AWS services that do not support endpoint polici -The following is example output. +The following is example output. The complete output is not shown. @@ -531,32 +590,2 @@ The following is example output. - "com.amazonaws.us-east-1.cleanrooms-ml", - "com.amazonaws.us-east-1.cloudtrail", - "com.amazonaws.us-east-1.codeguru-profiler", - "com.amazonaws.us-east-1.codeguru-reviewer", - "com.amazonaws.us-east-1.codepipeline", - "com.amazonaws.us-east-1.codewhisperer", - "com.amazonaws.us-east-1.datasync", - "com.amazonaws.us-east-1.datazone", - "com.amazonaws.us-east-1.deviceadvisor.iot", - "com.amazonaws.us-east-1.eks", - "com.amazonaws.us-east-1.email-smtp", - "com.amazonaws.us-east-1.glue.dashboard", - "com.amazonaws.us-east-1.grafana-workspace", - "com.amazonaws.us-east-1.iot.credentials", - "com.amazonaws.us-east-1.iot.data", - "com.amazonaws.us-east-1.iotwireless.api", - "com.amazonaws.us-east-1.lorawan.cups", - "com.amazonaws.us-east-1.lorawan.lns", - "com.amazonaws.us-east-1.macie2", - "com.amazonaws.us-east-1.neptune-graph", - "com.amazonaws.us-east-1.neptune-graph-fips", - "com.amazonaws.us-east-1.outposts", - "com.amazonaws.us-east-1.pipes-data", - "com.amazonaws.us-east-1.q", - "com.amazonaws.us-east-1.redshift-data", - "com.amazonaws.us-east-1.redshift-data-fips", - "com.amazonaws.us-east-1.refactor-spaces", - "com.amazonaws.us-east-1.sagemaker.runtime-fips", - "com.amazonaws.us-east-1.storagegateway", - "com.amazonaws.us-east-1.transfer", - "com.amazonaws.us-east-1.transfer.server", - "com.amazonaws.us-east-1.verifiedpermissions" + . . . + "com.amazonaws.us-east-1.transfer.server" @@ -575 +604 @@ To view IPv6 support for AWS services, see [AWS services that support IPv6](http -The following is example output: +The following is example output. The complete output is not shown. @@ -578,0 +608,3 @@ The following is example output: + "api.aws.us-east-1.cassandra-streams", + "aws.api.us-east-1.bcm-data-exports", + "aws.api.us-east-1.freetier", @@ -580,0 +613,6 @@ The following is example output: + "aws.api.us-east-1.resource-explorer-2", + "aws.api.us-east-1.resource-explorer-2-fips", + "aws.sagemaker.us-east-1.experiments", + "aws.sagemaker.us-east-1.partner-app",