AWS apprunner documentation change
Summary
Updated documentation to generalize endpoint references from 'public endpoint' to 'endpoint', added private endpoint management guidance, and restructured content about IPv4/IPv6 dual-stack configuration
Security assessment
The changes primarily improve clarity about dual-stack support for both public and private endpoints. While IPv6 adoption can have security implications, there's no evidence of addressing a specific vulnerability. The documentation now explicitly mentions managing dual-stack for private endpoints (a security-related feature), but this represents feature documentation rather than patching a security issue.
Diff
diff --git a/apprunner/latest/dg/network-dual-stack.md b/apprunner/latest/dg/network-dual-stack.md index 827f60067..bfe60455c 100644 --- a//apprunner/latest/dg/network-dual-stack.md +++ b//apprunner/latest/dg/network-dual-stack.md @@ -5 +5 @@ -Background information about IPv4 vs IPv6Manage dual stack for public endpoint +Manage dual stack for endpoint @@ -7 +7 @@ Background information about IPv4 vs IPv6Manage dual stack for public endpoint -# Enabling IPv6 for public incoming traffic +# Enabling IPv6 for incoming traffic @@ -9 +9 @@ Background information about IPv4 vs IPv6Manage dual stack for public endpoint -If you want your service to receive incoming network traffic from IPv6 addresses, or from both IPv4 and IPv6 addresses, choose the **Dual-stack** address type for the public endpoint. When you’re creating a new application, you can find this setting under **Configure service** > **Networking** section. For more information about how to enable IPv6 using App Runner console or App Runner API, see Managing dual stack for public incoming traffic. +If you want your service to receive incoming network traffic from IPv6 addresses, or from both IPv4 and IPv6 addresses, choose the **Dual-stack** address type for the endpoint. When you’re creating a new application, you can find this setting under **Configure service** > **Networking** section. The following procedures explain how to enable IPv4 or dual-stack (IPv6 and IPv4) using the App Runner console or the App Runner API. @@ -11 +11 @@ If you want your service to receive incoming network traffic from IPv6 addresses -For more information about adopting IPv6 on AWS, see [IPv6 on AWS](https://docs.aws.amazon.com/whitepapers/latest/ipv6-on-aws/internet-protocol-version-6.html). +## Managing dual stack for incoming traffic @@ -13,17 +13 @@ For more information about adopting IPv6 on AWS, see [IPv6 on AWS](https://docs. -App Runner supports dual stack only for public App Runner service endpoints. For all App Runner private services, only IPv4 is supported. - -###### Note - -When you have **IP address type** set to **Dual-stack** and you change your network configuration from public to private endpoint, App Runner will automatically change your address type to IPv4. This is because App Runner supports IPv6 only for public endpoints. - -## Learn background information about IPv4 vs IPv6 - -The IPv4 network layer, commonly used to route network traffic across the internet, uses a 32-bit address scheme. This address space is limited and can be exhausted with large numbers of network devices. For this reason, Network Address Translation (NAT) is typically used to route multiple IPv4 addresses through a single public network address. - -IPv6, a more recent version of the Internet Protocol, builds upon IPv4 and expands the address space with a 128-bit addressing scheme. With IPv6, you can build a network with an almost unlimited number of connected devices. Due to the vast amount of network addresses, NAT is not needed by IPv6. - -IPv4 and IPv6 endpoints are not compatible with each other because IPv4 endpoints cannot receive incoming IPv6 traffic and vice versa. Dual stack provides a convenient solution, where both IPv4 and IPv6 network traffic can be supported simultaneously. - -## Managing dual stack for public incoming traffic - -Manage the dual-stack address type for public incoming traffic using one of the following methods: +Manage the dual-stack address type for incoming traffic using one of the following methods: @@ -37,0 +22,4 @@ Manage the dual-stack address type for public incoming traffic using one of the +###### Note + +The following procedures explain how to manage the network address type for **public** incoming traffic. For information about managing dual-stack or IPv4 address types for **private** endpoints, see [Managing Private endpoints](./network-pl-manage.html). + @@ -46 +34,3 @@ You can choose dual-stack address type for the incoming internet traffic, when y - 2. Choose **Public endpoint** , for **Incoming network traffic**. **Public endpoint IP address type** option opens. + 2. Choose **Public endpoint** for **Incoming network traffic**. If you select **Public endpoint** , the **Endpoint IP address type** option opens. + +See [Managing Private endpoints](./network-pl-manage.html) for a procedure to manage dual-stack or IPv4 address types for private endpoints. @@ -48 +38 @@ You can choose dual-stack address type for the incoming internet traffic, when y - 3. Expand **Public endpoint IP address type** to view the following IP address types. + 3. Expand **Endpoint IP address type** to view the following IP address types. @@ -56 +46 @@ You can choose dual-stack address type for the incoming internet traffic, when y -If you do not expand **Public endpoint IP address type** to make a selection, then App Runner assigns IPv4 as the default configuration. +If you do not expand **Endpoint IP address type** to make a selection, then App Runner assigns IPv4 as the default configuration. @@ -67,4 +56,0 @@ When the service is deployed, your application starts receiving network traffic -###### Note - -Currently, App Runner supports IPv6 only for public endpoints. IPv6 endpoints are not supported for App Runner services hosted in an Amazon Virtual Private Cloud (Amazon VPC). If you update a service that's using _dual-stack public endpoint_ to a _private endpoint_ , your App Runner service will default to support traffic from only _IPv4 endpoints_ and fail to receive traffic from IPv6 endpoints. - @@ -75 +61 @@ Currently, App Runner supports IPv6 only for public endpoints. IPv6 endpoints ar - 2. Navigate to **Public endpoint IP address type** under **Incoming network traffic** and select the required address type. + 2. Navigate to **Endpoint IP address type** under **Incoming network traffic** and select the required address type. @@ -85,0 +72,4 @@ When you call the [CreateService](https://docs.aws.amazon.com/apprunner/latest/a +###### Note + +For private endpoint examples, see [App Runner API or AWS CLI](./network-pl-manage.html#network-pl-manage.api). + @@ -165,4 +154,0 @@ The following is the example to create a service with the dual stack as IP addre -###### Note - -Currently, App Runner supports IPv6 only for public endpoints. IPv6 endpoints are not supported for App Runner services hosted in an Amazon Virtual Private Cloud (Amazon VPC). If you update a service that's using _dual-stack public endpoint_ to a _private endpoint_ , your App Runner service will default to support traffic from only _IPv4 endpoints_ and fail to receive traffic from IPv6 endpoints. - @@ -177 +163 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Manage Private endpoint +Manage Private endpoints