AWS cli medium security documentation change
Summary
Updated CLI reference documentation for VPC Lattice resource gateways, including parameter reordering, added IPv4 addresses per ENI field, modified security group/subnet ID handling, and clarified IP address type requirements
Security assessment
The change makes '--security-group-ids' optional (previously required) and removes regex anchors from security group ID validation patterns. This could allow resource gateways to be created without security groups or with improperly formatted IDs, potentially leading to unintended network exposure if administrators omit security group configurations.
Diff
diff --git a/cli/latest/reference/vpc-lattice/create-resource-gateway.md b/cli/latest/reference/vpc-lattice/create-resource-gateway.md index 0b7bb06ef..06a9b865c 100644 --- a//cli/latest/reference/vpc-lattice/create-resource-gateway.md +++ b//cli/latest/reference/vpc-lattice/create-resource-gateway.md @@ -15 +15 @@ - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) » @@ -60 +60 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -Creates a resource gateway. +A resource gateway is a point of ingress into the VPC where a resource resides. It spans multiple Availability Zones. For your resource to be accessible from all Availability Zones, you should create your resource gateways to span as many Availability Zones as possible. A VPC can have multiple resource gateways. @@ -69 +68,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la - [--ip-address-type <value>] @@ -70,0 +70,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la + [--vpc-identifier <value>] + [--subnet-ids <value>] @@ -72 +73,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la - --subnet-ids <value> + [--ip-address-type <value>] + [--ipv4-addresses-per-eni <value>] @@ -74 +75,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la - --vpc-identifier <value> @@ -107,13 +108 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * pattern: `[!-~]+` -> - - -`--ip-address-type` (string) - -> The type of IP address used by the resource gateway. -> -> Possible values: -> -> * `IPV4` -> * `IPV6` -> * `DUALSTACK` +> * pattern: `.*[!-~]+.*` @@ -131 +120 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * pattern: `^(?!rgw-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+$` +> * pattern: `(?!rgw-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+` @@ -135 +124 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -`--security-group-ids` (list) +`--vpc-identifier` (string) @@ -137 +126 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> The IDs of the security groups to apply to the resource gateway. The security groups must be in the same VPC. +> The ID of the VPC for the resource gateway. @@ -141,2 +130,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * min: `0` -> * max: `5` +> * min: `5` +> * max: `50` +> * pattern: `vpc-(([0-9a-z]{8})|([0-9a-z]{17}))` @@ -144,0 +135,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la + +`--subnet-ids` (list) + +> The IDs of the VPC subnets in which to create the resource gateway. @@ -152 +145,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la ->> * pattern: `^sg-(([0-9a-z]{8})|([0-9a-z]{17}))$` @@ -162 +155,9 @@ Syntax: -`--subnet-ids` (list) [required] +`--security-group-ids` (list) + +> The IDs of the security groups to apply to the resource gateway. The security groups must be in the same VPC. +> +> Constraints: +> +> * min: `0` +> * max: `5` +> @@ -164 +164,0 @@ Syntax: -> The IDs of the VPC subnets in which to create the resource gateway. @@ -171,0 +172 @@ Syntax: +>> * pattern: `sg-(([0-9a-z]{8})|([0-9a-z]{17}))` @@ -180,0 +182,31 @@ Syntax: +`--ip-address-type` (string) + +> A resource gateway can have IPv4, IPv6 or dualstack addresses. The IP address type of a resource gateway must be compatible with the subnets of the resource gateway and the IP address type of the resource, as described here: +> +> * **IPv4** Assign IPv4 addresses to your resource gateway network interfaces. This option is supported only if all selected subnets have IPv4 address ranges, and the resource also has an IPv4 address. +> * **IPv6** Assign IPv6 addresses to your resource gateway network interfaces. This option is supported only if all selected subnets are IPv6 only subnets, and the resource also has an IPv6 address. +> * **Dualstack** Assign both IPv4 and IPv6 addresses to your resource gateway network interfaces. This option is supported only if all selected subnets have both IPv4 and IPv6 address ranges, and the resource either has an IPv4 or IPv6 address. +> + +> +> The IP address type of the resource gateway is independent of the IP address type of the client or the VPC endpoint through which the resource is accessed. +> +> Possible values: +> +> * `IPV4` +> * `IPV6` +> * `DUALSTACK` +> + + +`--ipv4-addresses-per-eni` (integer) + +> The number of IPv4 addresses in each ENI for the resource gateway. +> +> Constraints: +> +> * min: `1` +> * max: `62` +> + + @@ -231,12 +262,0 @@ JSON Syntax: -`--vpc-identifier` (string) [required] - -> The ID of the VPC for the resource gateway. -> -> Constraints: -> -> * min: `5` -> * max: `50` -> * pattern: `^vpc-(([0-9a-z]{8})|([0-9a-z]{17}))$` -> - - @@ -382 +402 @@ For more information, see [Resource gateways in VPC Lattice](https://docs.aws.am -arn -> (string) +name -> (string) @@ -384 +404 @@ arn -> (string) -> The Amazon Resource Name (ARN) of the resource gateway. +> The name of the resource gateway. @@ -388,3 +408,3 @@ arn -> (string) -> * min: `20` -> * max: `2048` -> * pattern: `^arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:resourcegateway/rgw-[0-9a-z]{17}$` +> * min: `3` +> * max: `40` +> * pattern: `(?!rgw-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+` @@ -402 +422 @@ id -> (string) -> * pattern: `^rgw-[0-9a-z]{17}$` +> * pattern: `rgw-[0-9a-z]{17}` @@ -406,13 +426 @@ id -> (string) -ipAddressType -> (string) - -> The type of IP address for the resource gateway. -> -> Possible values: -> -> * `IPV4` -> * `IPV6` -> * `DUALSTACK` -> - - -name -> (string) +arn -> (string) @@ -420 +428 @@ name -> (string) -> The name of the resource gateway. +> The Amazon Resource Name (ARN) of the resource gateway. @@ -424,11 +432,3 @@ name -> (string) -> * min: `3` -> * max: `40` -> * pattern: `^(?!rgw-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+$` -> - - -securityGroupIds -> (list) - -> The IDs of the security groups for the resource gateway. -> -> (string) +> * min: `20` +> * max: `2048` +> * pattern: `arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:resourcegateway/rgw-[0-9a-z]{17}` @@ -436,6 +435,0 @@ securityGroupIds -> (list) ->> Constraints: ->> ->> * min: `5` ->> * max: `200` ->> * pattern: `^sg-(([0-9a-z]{8})|([0-9a-z]{17}))$` ->> @@ -459,0 +454,12 @@ status -> (string) +vpcIdentifier -> (string) + +> The ID of the VPC. +> +> Constraints: +> +> * min: `5` +> * max: `50` +> * pattern: `vpc-(([0-9a-z]{8})|([0-9a-z]{17}))` +> + + @@ -473 +479 @@ subnetIds -> (list) -vpcIdentifier -> (string) +securityGroupIds -> (list) @@ -475 +481,27 @@ vpcIdentifier -> (string) -> The ID of the VPC. +> The IDs of the security groups for the resource gateway. +> +> (string) +> +>> Constraints: +>> +>> * min: `5` +>> * max: `200`