AWS appsync documentation change
Summary
Expanded documentation about AWS AppSync PrivateLink support, adding details about separate data plane and control plane endpoints. Added CLI examples for both endpoint types, console configuration steps, and control plane operation examples.
Security assessment
The changes document security-focused networking features (PrivateLink) that enable private API access and management without internet exposure. While this improves security posture by reducing attack surface, there's no evidence of addressing a specific vulnerability. The changes primarily enhance documentation about existing security capabilities.
Diff
diff --git a/appsync/latest/devguide/using-private-apis.md b/appsync/latest/devguide/using-private-apis.md index 892d243e0..d12fb436f 100644 --- a//appsync/latest/devguide/using-private-apis.md +++ b//appsync/latest/devguide/using-private-apis.md @@ -5 +5 @@ -Creating AWS AppSync Private APIsCreating an interface endpoint for AWS AppSyncAdvanced examplesUsing IAM policies to limit public API creation +Creating AWS AppSync Private APIsCreating interface endpoints for AWS AppSyncAdvanced examplesControl plane examplesUsing IAM policies to limit public API creationVPC PrivateLink support @@ -11 +11,10 @@ If you use Amazon Virtual Private Cloud (Amazon VPC), you can create AWS AppSync -To establish a private connection between your VPC and the AWS AppSync service, you must create an [interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html). Interface endpoints are powered by [AWS PrivateLink](http://aws.amazon.com/privatelink), which enables you to privately access AWS AppSync APIs without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC don't need public IP addresses to communicate with AWS AppSync APIs. Traffic between your VPC and AWS AppSync doesn't leave the AWS network. +To establish a private connection between your VPC and the AWS AppSync service, you must create interface VPC endpoints. Interface endpoints are powered by [AWS PrivateLink](http://aws.amazon.com/privatelink), which enables you to privately access AWS AppSync APIs without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC don't need public IP addresses to communicate with AWS AppSync APIs. Traffic between your VPC and AWS AppSync doesn't leave the AWS network. + +AWS AppSync supports AWS PrivateLink for both data plane and control plane operations: + + * **Data plane endpoint** (`com.amazonaws.{region}.appsync-api`): Provides private access to your GraphQL and Real-time APIs for querying, mutations, and subscriptions. + + * **Control plane endpoint** (`com.amazonaws.{region}.appsync`): Provides private access to AWS AppSync management operations such as creating APIs, updating schemas, and configuring data sources. + + + @@ -55 +64,12 @@ You can enable Private API features only during the creation of the API. This se -Before you can use your AWS AppSync Private API, you must configure an interface endpoint for AWS AppSync in your VPC. Note that both the Private API and VPC must be in the same AWS account and Region. +Before you can use your AWS AppSync Private API, you must configure interface endpoints for AWS AppSync in your VPC. Note that both the Private API and VPC must be in the same AWS account and Region. + +## Creating interface endpoints for AWS AppSync + +You can create interface endpoints for AWS AppSync using either the Amazon VPC console or the AWS Command Line Interface (AWS CLI). Depending on your use case, you may need to create one or both endpoint types: + + * **Data plane endpoint** : Required for accessing Private APIs from your VPC + + * **Control plane endpoint** : Required for managing AWS AppSync resources from your VPC using the AWS CLI or SDKs + + + @@ -57 +77 @@ Before you can use your AWS AppSync Private API, you must configure an interface -## Creating an interface endpoint for AWS AppSync +For more information, see [Creating an interface endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#create-interface-endpoint) in the _Amazon VPC User Guide_. @@ -59 +79,3 @@ Before you can use your AWS AppSync Private API, you must configure an interface -You can create an interface endpoint for AWS AppSync using either the Amazon VPC console or the AWS Command Line Interface (AWS CLI). For more information, see [Creating an interface endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#create-interface-endpoint) in the _Amazon VPC User Guide_. +###### Note + +Make sure you select the right VPC endpoint service; there are two for AppSync: `com.amazonaws.{region}.appsync-api` is the one required for private APIs while `com.amazonaws.{region}.appsync` is used for API management. @@ -70 +92,7 @@ Console - 2. In the **Services** table, choose `com.amazonaws.{region}.appsync-api`. Verify that the **Type** column value is `Interface`. + 2. In the **Services** table, choose one of the following services: + + * For data plane access: `com.amazonaws.{region}.appsync-api` + + * For control plane access: `com.amazonaws.{region}.appsync` + +Verify that the **Type** column value is `Interface`. @@ -79,0 +108,2 @@ Console + 4. Repeat the process to create the second endpoint type if needed. + @@ -86 +116,3 @@ CLI -Use the `[create-vpc-endpoint](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc-endpoint.html)` command and specify the VPC ID, VPC endpoint type (interface), service name, subnets that will use the endpoint, and security groups to associate with the endpoint's network interfaces. For example: +Use the `[create-vpc-endpoint](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc-endpoint.html)` command and specify the VPC ID, VPC endpoint type (interface), service name, subnets that will use the endpoint, and security groups to associate with the endpoint's network interfaces. + +**Create data plane endpoint:** @@ -93,0 +126,8 @@ Use the `[create-vpc-endpoint](https://docs.aws.amazon.com/cli/latest/reference/ +**Create control plane endpoint:** + + + $ aws ec2 create-vpc-endpoint —vpc-id vpc-ec43eb89 \ + —vpc-endpoint-type Interface \ + —service-name com.amazonaws.{region}.appsync \ + —subnet-id subnet-abababab —security-group-id sg-1a2b3c4d + @@ -98,0 +139,5 @@ To use the private DNS option, you must set the `enableDnsHostnames` and `enable +For control plane operations, you can use the standard AWS AppSync service endpoint: + + + https://appsync.{region}.amazonaws.com + @@ -221,0 +267,37 @@ Afterwards, a subscription is trigged, and the message notification appears as s +## Control plane examples + +With the control plane VPC endpoint configured, you can manage AWS AppSync resources from within your VPC using the AWS CLI or SDKs. Here are examples of common control plane operations: + +**Creating an API using the AWS CLI** + + + aws appsync create-graphql-api \ + --name "MyPrivateAPI" \ + --authentication-type API_KEY \ + --visibility PRIVATE + +**Updating a schema** + + + aws appsync start-schema-creation \ + --api-id {api-id} \ + --definition file://schema.graphql + +**Creating a data source** + + + aws appsync create-data-source \ + --api-id {api-id} \ + --name "MyDataSource" \ + --type AWS_LAMBDA \ + --lambda-config lambdaFunctionArn=arn:aws:lambda:{region}:{account}:function:MyFunction + +When using the control plane endpoint with private DNS enabled, these commands will automatically route through your VPC endpoint. If private DNS is not enabled, you can specify the endpoint URL: + + + aws appsync create-graphql-api \ + --endpoint-url https://{vpc_endpoint_id}-{endpoint_dns_identifier}.appsync.{region}.vpce.amazonaws.com \ + --name "MyPrivateAPI" \ + --authentication-type API_KEY \ + --visibility PRIVATE + @@ -255,0 +338,15 @@ An IAM administrator could also add the following [service control policy](https +## VPC PrivateLink support + +VPC Privatelink support is available in AWS AppSync. PrivateLink allows you to use and interact with an AWS Service without any traffic leaving the AWS network. + +AWS AppSync supports AWS PrivateLink for both data plane and control plane operations. + + * **VPCE endpoint** (`appsync.<region>.vpce.amazonaws.com`): Provides VPC access to data plane and control plane operations as follows: + + * **appsync** for control plane operations + + * **appsync-api** for data plane operations + + + +