AWS AWSEC2 documentation change
Summary
Expanded documentation with IP address type configuration (ipv4/dualstack/ipv6), updated prerequisites/considerations, and added CLI/console examples for IP type selection
Security assessment
The changes document security-relevant network configuration options (IP address type enforcement, subnet compatibility) but do not indicate a security vulnerability fix. The IP type selection helps users implement least-privilege network access, which is a security best practice.
Diff
diff --git a/AWSEC2/latest/UserGuide/create-ec2-instance-connect-endpoints.md b/AWSEC2/latest/UserGuide/create-ec2-instance-connect-endpoints.md index 2eddc946f..9b1801e2d 100644 --- a//AWSEC2/latest/UserGuide/create-ec2-instance-connect-endpoints.md +++ b//AWSEC2/latest/UserGuide/create-ec2-instance-connect-endpoints.md @@ -9 +9 @@ You can create an EC2 Instance Connect Endpoint to allow secure connection to yo -###### Prerequisites +###### Considerations @@ -11 +11,7 @@ You can create an EC2 Instance Connect Endpoint to allow secure connection to yo -You must have the required IAM permissions to create an EC2 Instance Connect Endpoint. For more information, see [Permissions to create, describe, modify, and delete EC2 Instance Connect Endpoints](./permissions-for-ec2-instance-connect-endpoint.html#iam-CreateInstanceConnectEndpoint). + * **Shared subnets** – You can create an EC2 Instance Connect Endpoint in a subnet shared with you. However, you can't use EC2 Instance Connect Endpoints that the VPC owner created in a subnet shared with you. + + * **IP address types** – EC2 Instance Connect Endpoints support the following address types, which must be compatible with your subnet: + + * `ipv4` – Connect only to EC2 instances with private IPv4 addresses. + + * `dualstack` – Connect to EC2 instances with either private IPv4 addresses or IPv6 addresses. @@ -13 +19,6 @@ You must have the required IAM permissions to create an EC2 Instance Connect End -###### Shared subnets + * `ipv6` – Connect only to EC2 instances with IPv6 addresses. + + + + +###### Prerequisites @@ -15 +26 @@ You must have the required IAM permissions to create an EC2 Instance Connect End -You can create an EC2 Instance Connect Endpoint in a subnet that is shared with you. You can't use a EC2 Instance Connect Endpoint that the VPC owner created in a subnet that is shared with you. +You must have the required IAM permissions to create an EC2 Instance Connect Endpoint. For more information, see [Permissions to create, describe, modify, and delete EC2 Instance Connect Endpoints](./permissions-for-ec2-instance-connect-endpoint.html#iam-CreateInstanceConnectEndpoint). @@ -35,0 +47,4 @@ Console +###### Note + +This option is only available when the endpoint's IP address type is configured as IPv4. + @@ -40 +55,3 @@ Console - 7. (Optional) To add a tag, choose **Add new tag** and enter the tag key and the tag value. + 7. For **IP address type** , choose the IP address type for the endpoint. Choose **Dualstack** if you need to support both IPv4 and IPv6 connections to your instances. Choose **IPv4** if you need to support client IP preservation. + + 8. (Optional) To add a tag, choose **Add new tag** and enter the tag key and the tag value. @@ -59 +76,9 @@ Use the [create-instance-connect-endpoint](https://docs.aws.amazon.com/cli/lates - aws ec2 create-instance-connect-endpoint --subnet-id subnet-0123456789example + aws ec2 create-instance-connect-endpoint \ + --subnet-id subnet-0123456789example + +To specify the type of traffic that the endpoint supports, include the `--ip-address-type` parameter. Valid values are `ipv4`, `dualstack`, or `ipv6`. The subnet must support the IP address type that you specify. When the `--ip-address-type` parameter is omitted, the default value is determined by the IP address type supported by the subnet. + + + aws ec2 create-instance-connect-endpoint \ + --subnet-id subnet-0123456789example \ + --ip-address-type ipv4 @@ -83 +108,2 @@ The following is example output. - "Tags": [] + "Tags": [], + "IpAddressType": "ipv4" @@ -107,0 +134,5 @@ Use the [New-EC2InstanceConnectEndpoint](https://docs.aws.amazon.com/powershell/ +To specify the type of traffic that the endpoint supports, include the `-IpAddressType` parameter. Valid values are `ipv4`, `dualstack`, or `ipv6`. The subnet must support the IP address type that you specify. When the `-IpAddressType` parameter is omitted, the default value is determined by the IP address type supported by the subnet. + + + New-EC2InstanceConnectEndpoint -SubnetId subnet-0123456789example -IpAddressType ipv4 + @@ -125,0 +157 @@ The following is example output. + IpAddressType : ipv4