AWS fsx documentation change
Summary
Updated documentation to clarify IPv4/IPv6 endpoint address ranges, dual-stack file system support, and IP range selection logic for Multi-AZ deployments. Added details about overlapping IP addresses in the same VPC when using non-conflicting subnets.
Security assessment
The changes primarily clarify networking configurations (IPv4/IPv6 ranges, VPC peering with dual-stack support) and default IP allocation behavior. While proper IP range configuration is important for network security, there is no explicit mention of patching vulnerabilities, mitigating exploits, or addressing a specific security incident. The updates focus on feature documentation (dual-stack support) and operational best practices rather than security controls.
Diff
diff --git a/fsx/latest/ONTAPGuide/supported-fsx-clients.md b/fsx/latest/ONTAPGuide/supported-fsx-clients.md index c5dde7de4..5a7e9faef 100644 --- a//fsx/latest/ONTAPGuide/supported-fsx-clients.md +++ b//fsx/latest/ONTAPGuide/supported-fsx-clients.md @@ -129 +129 @@ The NFS, SMB, and ONTAP management endpoints on Amazon FSx for NetApp ONTAP Mult -These floating IP addresses are created in the VPC route tables that you associate with your file system, and are within the file system's `EndpointIpAddressRange` which you can specify during creation. The `EndpointIpAddressRange` uses the following address ranges, depending on how a file system is created: +These floating IP addresses are created in the VPC route tables that you associate with your file system, and are within the file system's `EndpointIPv4AddressRange` or `EndpointIPv6AddressRange` which you specify during creation. The endpoint IP address range uses the following address ranges, depending on how a file system is created: @@ -131 +131 @@ These floating IP addresses are created in the VPC route tables that you associa - * Multi-AZ file systems created using the Amazon FSx console use the last 64 IP addresses in the VPC's primary CIDR range for the file system's `EndpointIpAddressRange` by default. + * Multi-AZ dual-stack file systems created with the Amazon FSx console or Amazon FSx API by default use an available /118 IP address range selected by Amazon FSx from one of the VPC's CIDR ranges. You can have overlapping endpoint IP addresses for file systems deployed in the same VPC/route tables, as long as they don't overlap with any subnet. @@ -133 +133 @@ These floating IP addresses are created in the VPC route tables that you associa - * Multi-AZ file systems created using the AWS CLI or Amazon FSx API use an IP address range within the `198.19.0.0/16` address block for the `EndpointIpAddressRange` by default. + * Multi-AZ IPv4-only file systems created using the Amazon FSx console use the last 64 IP addresses in the VPC's primary CIDR range for the file system's endpoint IP address range by default. @@ -135 +135,3 @@ These floating IP addresses are created in the VPC route tables that you associa - * You can also specify your own IP address range when you use the **Standard create** option. The IP address range that you choose can either be inside or outside the VPC’s IP address range, as long as it doesn't overlap with any subnet, and as long as it isn't already used by another file system with the same VPC and route tables. For this option we recommend using a range that is inside the VPC's IP address range. +Multi-AZ IPv4-only file systems created using the AWS CLI or Amazon FSx API use an IP address range within the `198.19.0.0/16` address block for the endpoint IP address range by default. + + * For either network type, you can also specify your own IP address range when you use the **Standard create** option. The IP address range that you choose can either be inside or outside the VPC’s IP address range, as long as it doesn't overlap with any subnet, and as long as it isn't already used by another file system with the same VPC and route tables. For this option we recommend using a range that is inside the VPC's IP address range. @@ -183 +185 @@ Global File Cache | No -You can use either VPC Peering or AWS Transit Gateway to access your file system's NVMe, iSCSI, and inter-cluster endpoints from outside of the file system's deployment VPC. You can use VPC Peering to route NVMe, iSCSI, and inter-cluster traffic between VPCs. A VPC peering connection is a networking connection between two VPCs, and is used to route traffic between them using private IPv4 addresses. You can use VPC peering to connect VPCs within the same AWS Region or between different AWS Regions. For more information on VPC peering, see [What is VPC peering?](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) in the _Amazon VPC Peering Guide_. +You can use either VPC Peering or AWS Transit Gateway to access your file system's NVMe, iSCSI, and inter-cluster endpoints from outside of the file system's deployment VPC. You can use VPC Peering to route NVMe, iSCSI, and inter-cluster traffic between VPCs. A VPC peering connection is a networking connection between two VPCs, and is used to route traffic between them using private IPv4 or IPv6 addresses. You can use VPC peering to connect VPCs within the same AWS Region or between different AWS Regions. For more information on VPC peering, see [What is VPC peering?](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) in the _Amazon VPC Peering Guide_. @@ -197 +199,3 @@ Amazon FSx requires that you use AWS Transit Gateway or that you configure remot -Because the NFS, SMB, and management endpoints use floating IP addresses, you must use [AWS Transit Gateway](https://aws.amazon.com/transit-gateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) in conjunction with AWS Direct Connect or AWS VPN to access these interfaces from an on-premises network. The floating IP addresses used for these interfaces are within the `EndpointIpAddressRange` you specify when creating your Multi-AZ file system. The `EndpointIpAddressRange` uses the following address ranges, depending on how a file system is created: +Because the NFS, SMB, and management endpoints use floating IP addresses, you must use [AWS Transit Gateway](https://aws.amazon.com/transit-gateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) in conjunction with AWS Direct Connect or AWS VPN to access these interfaces from an on-premises network. The floating IP addresses used for these interfaces are within the `EndpointIPv4AddressRange` or `EndpointIPv6AddressRange` you specify when creating your Multi-AZ file system. The endpoint IP address range uses the following address ranges, depending on how a file system is created: + + * Multi-AZ dual-stack file systems created with the Amazon FSx console or Amazon FSx API by default use an available /118 IP address range selected by Amazon FSx from one of the VPC's CIDR ranges. You can have overlapping endpoint IP addresses for file systems deployed in the same VPC/route tables, as long as they don't overlap with any subnet. @@ -199 +203 @@ Because the NFS, SMB, and management endpoints use floating IP addresses, you mu - * Multi-AZ file systems created using the Amazon FSx console use the last 64 IP addresses in the VPC's primary CIDR range for the file system's `EndpointIpAddressRange` by default. + * Multi-AZ IPv4-only file systems created using the Amazon FSx console use the last 64 IP addresses in the VPC's primary CIDR range for the file system's endpoint IP address range by default. @@ -201 +205 @@ Because the NFS, SMB, and management endpoints use floating IP addresses, you mu - * Multi-AZ file systems created using the AWS CLI or Amazon FSx API use an IP address range within the `198.19.0.0/16` address block for the `EndpointIpAddressRange` by default. +Multi-AZ IPv4-only file systems created using the AWS CLI or Amazon FSx API use an IP address range within the `198.19.0.0/16` address block for the endpoint IP address range by default. @@ -203 +207 @@ Because the NFS, SMB, and management endpoints use floating IP addresses, you mu - * You can also specify your own IP address range when you use the **Standard create** option in the Amazon FSx console The IP address range that you choose can either be inside or outside the VPC’s IP address range, as long as it doesn't overlap with any subnet, and as long as it isn't already used by another file system with the same VPC and route tables. For this option we recommend using a range that is inside the VPC's IP address range. + * For either network type, you can also specify your own IP address range when you use the **Standard create** option. The IP address range that you choose can either be inside or outside the VPC’s IP address range, as long as it doesn't overlap with any subnet, and as long as it isn't already used by another file system with the same VPC and route tables. For this option we recommend using a range that is inside the VPC's IP address range.