AWS cloudhsm documentation change
Summary
Clarified that the security group is created when creating a cluster or adding an HSM if it doesn't exist.
Security assessment
The change provides operational clarification about security group creation timing but doesn't address any security vulnerability or weakness.
Diff
diff --git a/cloudhsm/latest/userguide/configure-sg.md b/cloudhsm/latest/userguide/configure-sg.md index 25460ada3..1d24e7cda 100644 --- a//cloudhsm/latest/userguide/configure-sg.md +++ b//cloudhsm/latest/userguide/configure-sg.md @@ -7 +7 @@ -When you create a cluster, AWS CloudHSM creates a security group with the name `cloudhsm-cluster-`<clusterID>`-sg`. This security group contains a preconfigured TCP rule that allows inbound and outbound communication within the cluster security group over ports 2223-2225. This SG allows your EC2 instances to use your VPC to talk to HSMs in your cluster. +When you create a cluster or add an HSM to a cluster, AWS CloudHSM creates a security group with the name `cloudhsm-cluster-`<clusterID>`-sg` if one doesn't already exist. This security group contains a preconfigured TCP rule that allows inbound and outbound communication within the cluster security group over ports 2223-2225. This SG allows your EC2 instances to use your VPC to talk to HSMs in your cluster.