AWS vpc documentation change
Summary
Added detailed route table configuration requirements for transit gateway VPC attachments, clarified routing behavior between subnets and AZs
Security assessment
The changes clarify proper route table configuration requirements for secure traffic flow through transit gateways. While not fixing a specific vulnerability, they help prevent misconfigurations that could lead to unintended network exposure.
Diff
diff --git a/vpc/latest/tgw/tgw-vpc-attachments.md b/vpc/latest/tgw/tgw-vpc-attachments.md index 59f2c884f..fe7552b9b 100644 --- a//vpc/latest/tgw/tgw-vpc-attachments.md +++ b//vpc/latest/tgw/tgw-vpc-attachments.md @@ -5 +5 @@ -VPC attachment lifecycleAppliance modeSecurity group referencing +Route table requirements for VPC attachmentsVPC attachment lifecycleAppliance modeSecurity group referencing @@ -9 +9 @@ VPC attachment lifecycleAppliance modeSecurity group referencing -An Amazon Virtual Private Cloud (VPC) attachment to a transit gateway allows you to route traffic to and from one or more VPC subnets. When you attach a VPC to a transit gateway, you must specify one subnet from each Availability Zone to be used by the transit gateway to route traffic. Specifying one subnet from an Availability Zone enables traffic to reach resources in every subnet in that Availability Zone. +An Amazon Virtual Private Cloud (VPC) attachment to a transit gateway allows you to route traffic to and from one or more VPC subnets. When you attach a VPC to a transit gateway, you must specify one subnet from each Availability Zone to be used by the transit gateway to route traffic. The specified subnets serve as the entry and exit points for transit gateway traffic. Traffic can only reach resources in other subnets within the same Availability Zone if the transit gateway attachment subnets have appropriate routes configured in their route tables pointing to the target subnets. @@ -13 +13,5 @@ An Amazon Virtual Private Cloud (VPC) attachment to a transit gateway allows you - * When you attach a VPC to a transit gateway, any resources in Availability Zones where there is no transit gateway attachment cannot reach the transit gateway. If there is a route to the transit gateway in a subnet route table, traffic is forwarded to the transit gateway only when the transit gateway has an attachment in a subnet in the same Availability Zone. + * When you attach a VPC to a transit gateway, any resources in Availability Zones where there is no transit gateway attachment cannot reach the transit gateway. + +###### Note + +Within Availability Zones that do have transit gateway attachments, traffic is only forwarded to the transit gateway from the specific subnets that are associated with the attachment. If there is a route to the transit gateway in a subnet route table, traffic is forwarded to the transit gateway only when the transit gateway has an attachment in a subnet in the same Availability Zone and the attachment subnet's route table contains appropriate routes to the traffic's intended destination within the VPC. @@ -27,0 +32,17 @@ An Amazon Virtual Private Cloud (VPC) attachment to a transit gateway allows you +## Route table requirements for VPC attachments + +Transit gateway VPC attachments require specific route table configurations to function properly: + + * **Attachment subnet route tables** : The subnets associated with the transit gateway attachment must have route table entries for any destinations within the VPC that need to be reachable via the transit gateway. This includes routes to other subnets, internet gateways, NAT gateways, and VPC endpoints. + + * **Target subnet route tables** : Subnets containing resources that need to communicate through the transit gateway must have routes pointing back to the transit gateway for return traffic to external destinations. + + * **Local VPC traffic** : Transit gateway attachment does not automatically enable communication between subnets within the same VPC. Standard VPC routing rules apply, and the local route (VPC CIDR) must be present in route tables for intra-VPC communication. + + + + +###### Note + +Having routes configured in non-attachment subnets within the same Availability Zone does not enable traffic flow. Only the specific subnets associated with the transit gateway attachment can serve as entry/exit points for transit gateway traffic. +