AWS gameliftservers documentation change
Summary
Fixed grammatical errors, added a warning about required network configuration fields, clarified port management requirements, and corrected parameter names in examples.
Security assessment
The changes add a security warning about properly configuring InstanceConnectionPortRange and InstanceInboundPermissions to prevent undefined behavior, which could lead to security misconfigurations. The note about covering all ports in the connection range with inbound permissions helps prevent accidental exposure of unprotected ports. However, there's no evidence this addresses a specific existing vulnerability.
Diff
diff --git a/gameliftservers/latest/developerguide/containers-design-fleet.md b/gameliftservers/latest/developerguide/containers-design-fleet.md index ff8332acc..1b6b1aa0d 100644 --- a//gameliftservers/latest/developerguide/containers-design-fleet.md +++ b//gameliftservers/latest/developerguide/containers-design-fleet.md @@ -9 +9 @@ Set resource limitsDesignate essential containersConfigure network connectionsSe -The topics in this section describes some of the optional features for Amazon GameLift Servers managed containers. You can choose to use any or all of these features. +The topics in this section describe some of the optional features for Amazon GameLift Servers managed containers. You can choose to use any or all of these features. @@ -32 +32 @@ For each container group, you can determine how much memory and computing power -You can set a maximum limit on memory and computing power for a container group. By default, these resource are shared by all containers in the group. You can further customize resource management by setting limits for individual containers. +You can set a maximum limit on memory and computing power for a container group. By default, these resources are shared by all containers in the group. You can further customize resource management by setting limits for individual containers. @@ -37 +37 @@ You can set a maximum limit on memory and computing power for a container group. -Setting container-specific resource limits lets you exert greater control over how individual containers can use the group’s resources. If you don’t set container-specific limits, all containers in the group share the group resources. Sharing offers greater flexibility to use resources where they're needed. It also increases the potential for processes to compete with each other and result in container failure. +Setting container-specific resource limits allows you to exert greater control over how individual containers can use the group’s resources. If you don’t set container-specific limits, all containers in the group share the group resources. Sharing offers greater flexibility to use resources where they're needed. It also increases the potential for processes to compete with each other and result in container failure. @@ -78 +78 @@ Let’s say we’re defining a game server container group with the following th - * Container B runs is a support container with resource requirements estimated at 1024 MiB and 1536 CPU. We set a memory limit of 2048 MiB, and a CPU reserve limit of 1024 CPU. + * Container B is a support container with resource requirements estimated at 1024 MiB and 1536 CPU. We set a memory limit of 2048 MiB, and a CPU reserve limit of 1024 CPU. @@ -102 +102 @@ Set the `ContainerDefinition` property `Essential` to either true or false for e -You can customize network access to let external traffic connect to any container in a container fleet. For example, you must establish network connections to the container that runs your game server processes, so that game clients can join and play your game. Game clients connect to game servers using ports and IP addresses. +You can customize network access to allow external traffic connect to any container in a container fleet. For example, you must establish network connections to the container that runs your game server processes, so that game clients can join and play your game. Game clients connect to game servers using ports and IP addresses. @@ -106 +106 @@ In a container fleet, the connection between a client and server is not direct. -Amazon GameLift Servers provides an extra layer of control for your network connections. Each container fleet has an _inbound permissions_ setting, which lets you control access to each external-facing connection port. For example, you could remove permissions for all connection ports to shut off all access to the fleet's containers. +Amazon GameLift Servers provides an extra layer of control for your network connections. Each container fleet has an _inbound permissions_ setting, which allows you to control access to each external-facing connection port. For example, you could remove permissions for all connection ports to shut off all access to the fleet's containers. @@ -109,0 +110,4 @@ You can update a fleet's inbound permissions, connection ports, and container po +###### Warning + +If you provide a custom InstanceConnectionPortRange or InstanceInboundPermissions, Amazon GameLift Servers will no longer manage either value for your fleet. You must set both fields to avoid undefined behavior. + @@ -113 +117 @@ You can update a fleet's inbound permissions, connection ports, and container po -Configure container port ranges as part of each container definition. This is a required parameter for a container group definition. You need to configure enough ports to accommodate all concurrently running processes that need external access. Some containers won't need any ports. +Configure container port ranges as part of each container definition. This is a required parameter for a container group definition. You need to configure enough ports to accommodate all concurrently running processes that need external access. Some containers will not need any ports. @@ -141 +145,5 @@ By default, Amazon GameLift Servers calculates the number of ports required for -When you create a container fleet, define a set of inbound permissions (see [ ContainerFleet:InstanceInboundPermisssions](https://docs.aws.amazon.com/gameliftservers/latest/apireference/API_ContainerFleet.html)). Inbound permission ports should match with the fleet's connection port ranges. +When you create a container fleet, define a set of inbound permissions (see [ ContainerFleet:InstanceInboundPermissions](https://docs.aws.amazon.com/gameliftservers/latest/apireference/API_ContainerFleet.html)). Inbound permission ports should match with the fleet's connection port ranges. + +###### Note + +Since container ports are selected randomly from the InstanceConnectionPortRange, in order to guarantee that session connections can be made, all ports in InstanceConnectionPortRange should be covered by ports in InstanceInboundPermissions @@ -148 +156 @@ This example illustrates how to set all three network connection properties. - * Our fleet's game server container group has 1 container, which runs 1 game server processes. + * Our fleet's game server container group has 1 container, which runs 1 game server process. @@ -169 +177 @@ In the game server container group definition, we set the `PortConfiguration` pa -When creating the container fleet, we set the `ConnectionPortRange` parameter as follows: +When creating the container fleet, we set the `InstanceConnectionPortRange` parameter as follows: @@ -171 +179 @@ When creating the container fleet, we set the `ConnectionPortRange` parameter as - "ConnectionPortRange": { "FromPort": 1010, "ToPort": 1071 } + "InstanceConnectionPortRange": { "FromPort": 1010, "ToPort": 1071 } @@ -219 +227 @@ When you create a container fleet, consider the following decision points. Most -In general, you want to deploy your fleets geographically near your players to minimize latency. You can deploy your container fleet to any Each AWS Region that Amazon GameLift Servers supports. If you want to deploy the same game server to additional geographic locations, you can add remote locations to the fleet including AWS Regions and Local Zones. For a multi-location fleet, You can adjust capacity independently in each fleet location. For more information about supported fleet locations, see [Amazon GameLift Servers service locations](./gamelift-regions.html). +In general, you want to deploy your fleets geographically near your players to minimize latency. You can deploy your container fleet to any AWS Region that Amazon GameLift Servers supports. If you want to deploy the same game server to additional geographic locations, you can add remote locations to the fleet including AWS Regions and Local Zones. For a multi-location fleet, you can adjust capacity independently in each fleet location. For more information about supported fleet locations, see [Amazon GameLift Servers service locations](./gamelift-regions.html).