AWS vpc documentation change
Summary
Updated NAT gateway documentation with capitalization fixes, restructured 'Important' section into bullet points under 'Considerations', and added clarifications about source IP address behavior for public/private NAT gateways
Security assessment
The change clarifies NAT gateway behavior related to source IP addresses (Elastic IP vs private IP usage) which helps users understand network traffic flow and prevent misconfigurations. However, there's no evidence of addressing a specific security vulnerability.
Diff
diff --git a/vpc/latest/userguide/vpc-nat-gateway.md b/vpc/latest/userguide/vpc-nat-gateway.md index aa647f298..c8aeb12b1 100644 --- a//vpc/latest/userguide/vpc-nat-gateway.md +++ b//vpc/latest/userguide/vpc-nat-gateway.md @@ -11 +11 @@ When you create a NAT gateway, you specify one of the following connectivity typ - * **Public** – (Default) Instances in private subnets can connect to the internet through a public NAT gateway, but the instances can't receive unsolicited inbound connections from the internet. You create a public NAT gateway in a public subnet and must associate an elastic IP address with the NAT gateway at creation. You route traffic from the NAT gateway to the internet gateway for the VPC. Alternatively, you can use a public NAT gateway to connect to other VPCs or your on-premises network. In this case, you route traffic from the NAT gateway through a transit gateway or a virtual private gateway. + * **Public** – (Default) Instances in private subnets can connect to the internet through a public NAT gateway, but the instances can't receive unsolicited inbound connections from the internet. You create a public NAT gateway in a public subnet and must associate an Elastic IP address with the NAT gateway at creation. You route traffic from the NAT gateway to the internet gateway for the VPC. Alternatively, you can use a public NAT gateway to connect to other VPCs or your on-premises network. In this case, you route traffic from the NAT gateway through a transit gateway or a virtual private gateway. @@ -13 +13 @@ When you create a NAT gateway, you specify one of the following connectivity typ - * **Private** – Instances in private subnets can connect to other VPCs or your on-premises network through a private NAT gateway, but the instances can't receive unsolicited inbound connections from the other VPCs or the on-premises network. You can route traffic from the NAT gateway through a transit gateway or a virtual private gateway. You can't associate an elastic IP address with a private NAT gateway. You can attach an internet gateway to a VPC with a private NAT gateway, but if you route traffic from the private NAT gateway to the internet gateway, the internet gateway drops the traffic. + * **Private** – Instances in private subnets can connect to other VPCs or your on-premises network through a private NAT gateway, but the instances can't receive unsolicited inbound connections from the other VPCs or the on-premises network. You can route traffic from the NAT gateway through a transit gateway or a virtual private gateway. You can't associate an Elastic IP address with a private NAT gateway. You can attach an internet gateway to a VPC with a private NAT gateway, but if you route traffic from the private NAT gateway to the internet gateway, the internet gateway drops the traffic. @@ -22 +22 @@ Both private and public NAT gateways map the source private IPv4 address of the -###### Important +###### Considerations @@ -24 +24 @@ Both private and public NAT gateways map the source private IPv4 address of the -Connections must always be initiated from within the VPC containing the NAT Gateway. + * Connections must always be initiated from within the VPC containing the NAT gateway. @@ -26 +26,5 @@ Connections must always be initiated from within the VPC containing the NAT Gate -You can use either a public or private NAT gateway to route traffic to transit gateways and virtual private gateways. + * You can use either a public or private NAT gateway to route traffic to transit gateways and virtual private gateways. + + * If you use a private NAT gateway to connect to a transit gateway or virtual private gateway, traffic to the destination will come from the private IP address of the private NAT gateway. + + * If you use a public NAT gateway to connect to a transit gateway or virtual private gateway, traffic to the destination will come from the private IP address of the public NAT gateway. The public NAT gateway only uses its Elastic IP address as the source IP address when used in conjunction with an internet gateway in the same VPC. @@ -28 +31,0 @@ You can use either a public or private NAT gateway to route traffic to transit g -If you use a private NAT gateway to connect to a transit gateway or virtual private gateway, traffic to the destination will come from the private IP address of the private NAT gateway. @@ -30 +32,0 @@ If you use a private NAT gateway to connect to a transit gateway or virtual priv -If you use a public NAT gateway to connect to a transit gateway or virtual private gateway, traffic to the destination will come from the private IP address of the public NAT gateway. The public NAT gateway will only use its EIP as the source IP address when used in conjunction with an internet gateway in the same VPC. @@ -32 +33,0 @@ If you use a public NAT gateway to connect to a transit gateway or virtual priva -NAT gateways support traffic with a maximum transmission unit (MTU) of 8500. For more information, see [NAT gateway basics](./nat-gateway-basics.html).