AWS AWSEC2 medium security documentation change
Summary
Added IPv6 support documentation for EC2 Instance Connect Endpoint security groups, including IPv6 CIDR examples and updated source/destination specifications
Security assessment
Expands security group configuration guidance to include IPv6, which is critical for proper network security controls. Missing IPv6 documentation could lead to misconfigurations. The change explicitly addresses secure network access by clarifying both IPv4 and IPv6 requirements.
Diff
diff --git a/AWSEC2/latest/UserGuide/eice-security-groups.md b/AWSEC2/latest/UserGuide/eice-security-groups.md index c6eb5ea69..9054ae8d3 100644 --- a//AWSEC2/latest/UserGuide/eice-security-groups.md +++ b//AWSEC2/latest/UserGuide/eice-security-groups.md @@ -24 +24 @@ The following examples show you how to configure the security group rules for th -The security group rules for an EC2 Instance Connect Endpoint must allow outbound traffic destined for the target instances to leave the endpoint. You can specify either the instance security group or the IPv4 address range of the VPC as the destination. +The security group rules for an EC2 Instance Connect Endpoint must allow outbound traffic destined for the target instances to leave the endpoint. You can specify either the instance security group or the IPv4 or IPv6 address range of the VPC as the destination. @@ -43,0 +44,8 @@ TCP | `VPC IPv4 CIDR` | 22 | Allows outbound SSH traffic to the VPC +###### Example outbound rule: IPv6 address range + +The following example allows outbound traffic to the specified IPv6 address range. The IPv6 addresses of an instance is assigned from its subnet, so you can use the IPv6 address range of the VPC. + +Protocol | Destination | Port range | Comment +---|---|---|--- +TCP | `VPC IPv6 CIDR` | 22 | Allows outbound SSH traffic to the VPC + @@ -46 +54 @@ TCP | `VPC IPv4 CIDR` | 22 | Allows outbound SSH traffic to the VPC -The security group rules for target instances must allow inbound traffic from the EC2 Instance Connect Endpoint. You can specify either the endpoint security group or an IPv4 address range as the source. If you specify an IPv4 address range, the source depends on whether client IP preservation is off or on. For more information, see [Considerations](./connect-with-ec2-instance-connect-endpoint.html#ec2-instance-connect-endpoint-prerequisites). +The security group rules for target instances must allow inbound traffic from the EC2 Instance Connect Endpoint. You can specify either the endpoint security group or an IPv4 or IPv6 address range as the source. If you specify an IPv4 address range, the source depends on whether client IP preservation is off or on. For more information, see [Considerations](./connect-with-ec2-instance-connect-endpoint.html#ec2-instance-connect-endpoint-prerequisites).