AWS AWSEC2 documentation change
Summary
Added IPv6 support documentation for EC2 Instance Connect Endpoints, clarified IP address type requirements, and added note about client IP preservation limitations for IPv6/dual-stack endpoints
Security assessment
The changes clarify network security configurations (IP address type matching, client IP preservation limitations) but do not address a specific vulnerability. The client IP preservation note highlights a security-relevant limitation (logging/traceability impact for IPv6), but this is a feature documentation update rather than a security fix.
Diff
diff --git a/AWSEC2/latest/UserGuide/connect-with-ec2-instance-connect-endpoint.md b/AWSEC2/latest/UserGuide/connect-with-ec2-instance-connect-endpoint.md index 89e0de40f..8d5ce982b 100644 --- a//AWSEC2/latest/UserGuide/connect-with-ec2-instance-connect-endpoint.md +++ b//AWSEC2/latest/UserGuide/connect-with-ec2-instance-connect-endpoint.md @@ -13 +13 @@ EC2 Instance Connect Endpoint allows you to connect securely to an instance from - * You can connect to your instances without requiring the instances to have a public IPv4 address. AWS charges for all public IPv4 addresses, including public IPv4 addresses associated with running instances and Elastic IP addresses. For more information, see the **Public IPv4 Address** tab on the [Amazon VPC pricing page](https://aws.amazon.com/vpc/pricing/). + * You can connect to your instances without requiring the instances to have a public IPv4 or IPv6 address. AWS charges for all public IPv4 addresses, including public IPv4 addresses associated with running instances and Elastic IP addresses. For more information, see the **Public IPv4 Address** tab on the [Amazon VPC pricing page](https://aws.amazon.com/vpc/pricing/). @@ -73 +73 @@ Before you begin, consider the following. - * Your instance must have an IPv4 address (either private or public). EC2 Instance Connect Endpoint does not support connecting to instances using IPv6 addresses. + * You can create an EC2 Instance Connect Endpoint to support traffic to an instance that has a private IPv4 address or IPv6 address. The IP address type of the endpoint must match the IP address of the instance. You can create an endpoint that supports all IP address types. @@ -77 +77 @@ Before you begin, consider the following. - * You can assign a security group to an EC2 Instance Connect Endpoint when you create it. Otherwise, we use the default security group for the VPC. The security group for an EC2 Instance Connect Endpoint must allow outbound traffic to the destination instances. For more information, see [Security groups for EC2 Instance Connect Endpoint](./eice-security-groups.html). + * You can assign a security group to an EC2 Instance Connect Endpoint. Otherwise, we use the default security group for the VPC. The security group for an EC2 Instance Connect Endpoint must allow outbound traffic to the destination instances. For more information, see [Security groups for EC2 Instance Connect Endpoint](./eice-security-groups.html). @@ -84,0 +85,2 @@ Before you begin, consider the following. + * Client IP preservation is only supported on IPv4 EC2 Instance Connect Endpoints. To use client IP preservation, the IP address type of the EC2 Instance Connect Endpoint must be IPv4. Client IP preservation is not supported when the IP address type is dual-stack or IPv6. +