AWS apprunner documentation change
Summary
Updated documentation to reflect dual-stack support for Private Endpoints, removed IPv6 limitations, added configuration guidance for dual-stack traffic, and corrected typos.
Security assessment
The change adds a note advising users to ensure infrastructure and VPC endpoints support dual-stack traffic, which is a security best practice to prevent misconfiguration. However, it does not address a specific security vulnerability.
Diff
diff --git a/apprunner/latest/dg/network-pl-manage.md b/apprunner/latest/dg/network-pl-manage.md index 1f968fc14..6b96a20c6 100644 --- a//apprunner/latest/dg/network-pl-manage.md +++ b//apprunner/latest/dg/network-pl-manage.md @@ -7 +7 @@ App Runner consoleApp Runner API or AWS CLI -# Managing Private endpoint +# Managing Private endpoints @@ -37,4 +36,0 @@ To configure your incoming traffic, choose one of the following. -###### Note - -Currently, App Runner supports IPv6 only for public endpoints. IPv6 endpoints are not supported for App Runner services hosted in an Amazon Virtual Private Cloud (Amazon VPC). If you update a service that's using _dual-stack public endpoint_ to a _private endpoint_ , your App Runner service will default to support traffic from only _IPv4 endpoints_ and fail to receive traffic from IPv6 endpoints. - @@ -68,0 +65,4 @@ To learn more about infrastructure security and security groups, including best +###### Note + +If you're configuring the endpoint for dual stack make sure that your infrastructure and VPC endpoint supports dual-stack traffic. + @@ -159,4 +158,0 @@ For information on permissions required to make your service private, see [Permi -###### Note - -Currently, App Runner supports IPv6 only for public endpoints. IPv6 endpoints are not supported for App Runner services hosted in an Amazon Virtual Private Cloud (Amazon VPC). If you update a service that's using _dual-stack public endpoint_ to a _private endpoint_ , your App Runner service will default to support traffic from only _IPv4 endpoints_ and fail to receive traffic from IPv6 endpoints. - @@ -179 +175 @@ To learn more about infrastructure security and security groups, including best - 2. Reference the VPC interface endpoint by using the [CreateService](https://docs.aws.amazon.com/apprunner/latest/api/API_CreateService.html) or [UpdateService](https://docs.aws.amazon.com/apprunner/latest/api/API_UpdateService.html) App Runner API actions through the CLI. Configure your service to not be publically accessible. Set `IsPubliclyAccessible` to `False`in the `IngressConfiguration` member of the `NetworkConfiguration` parameter. The following is an example of referencing VPC interface endpoint. + 2. Reference the VPC interface endpoint by using the [CreateService](https://docs.aws.amazon.com/apprunner/latest/api/API_CreateService.html) or [UpdateService](https://docs.aws.amazon.com/apprunner/latest/api/API_UpdateService.html) App Runner API actions through the CLI. Configure your service to not be publicly accessible. Set `IsPubliclyAccessible` to `False` in the `IngressConfiguration` member of the `NetworkConfiguration` parameter. Optionally you can set the `IpAddressType` field to `IPV4` or `DUAL_STACK`. If not set, this value defaults to IPV4. The following example references the VPC interface endpoint. @@ -182,4 +178,3 @@ To learn more about infrastructure security and security groups, including best - --network-configuration: ingress-configuration=<ingress_configuration> - --service-name: com.amazonaws.us-east-1.apprunner.requests - --source-configuration: <source_configuration> - # Ingress Configuration + --network-configuration: + { + "IngressConfiguration": @@ -187,0 +183,2 @@ To learn more about infrastructure security and security groups, including best + }, + "IpAddressType": "IPV4" @@ -188,0 +186,2 @@ To learn more about infrastructure security and security groups, including best + --service-name: com.amazonaws.us-east-1.apprunner.requests + --source-configuration: <source_configuration> @@ -315 +314 @@ Enable Private endpoint -Enable IPv6 for App Runner's public endpoints +Enable IPv6 for App Runner's endpoints