AWS vpc medium security documentation change
Summary
Restructured console steps, added security group configuration requirements for VXLAN traffic (UDP 4789), and clarified cross-account sharing.
Security assessment
Explicitly requiring a security group rule for VXLAN traffic addresses a potential misconfiguration risk. This change directly documents a security control to prevent unintended exposure of mirrored traffic, indicating a security-related improvement.
Diff
diff --git a/vpc/latest/mirroring/create-traffic-mirroring-target.md b/vpc/latest/mirroring/create-traffic-mirroring-target.md index d7535e74e..cfca86820 100644 --- a//vpc/latest/mirroring/create-traffic-mirroring-target.md +++ b//vpc/latest/mirroring/create-traffic-mirroring-target.md @@ -11 +11 @@ Before you can delete a traffic mirror target, you must remove it from any traff -###### To create or delete a traffic mirror target using the console +After you create a target, assign it to a traffic mirror session. For more information, see [Create, modify, or delete a traffic mirror session](./create-traffic-mirroring-session.html). @@ -13 +13 @@ Before you can delete a traffic mirror target, you must remove it from any traff - 1. Open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). +You must configure a security group for the traffic mirror target that allows VXLAN traffic (UDP port 4789) from the traffic mirror source. @@ -15 +15 @@ Before you can delete a traffic mirror target, you must remove it from any traff - 2. In the **Region** selector, choose the AWS Region that you used when you created the mirror target. +You can share a traffic mirror target across accounts. For more information, see [Share a traffic mirror target](./tm-sharing.html). @@ -17 +17 @@ Before you can delete a traffic mirror target, you must remove it from any traff - 3. On the navigation pane, choose **Traffic Mirroring** , **Mirror targets**. +###### To create a traffic mirror target using the console @@ -19 +19 @@ Before you can delete a traffic mirror target, you must remove it from any traff - 4. To delete a target, select the traffic mirror target and choose **Delete**. + 1. Open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). @@ -21 +21 @@ Before you can delete a traffic mirror target, you must remove it from any traff -When prompted for confirmation, enter `delete`, and then choose **Delete**. The deletion process is complete. + 2. In the **Region** selector, choose the AWS Region that you used when you created the resource to use as the destination for the mirrored traffic. @@ -23 +23,3 @@ When prompted for confirmation, enter `delete`, and then choose **Delete**. The - 5. To create a target, choose **Create traffic mirror target**. + 3. On the navigation pane, choose **Traffic Mirroring** , **Mirror targets**. + + 4. Choose **Create traffic mirror target**. @@ -25 +27 @@ When prompted for confirmation, enter `delete`, and then choose **Delete**. The - 6. (Optional) For **Name tag** , enter a name for the traffic mirror target. + 5. (Optional) For **Name tag** , enter a name for the traffic mirror target. @@ -27 +29 @@ When prompted for confirmation, enter `delete`, and then choose **Delete**. The - 7. (Optional) For **Description** , enter a description for the traffic mirror target. + 6. (Optional) For **Description** , enter a description for the traffic mirror target. @@ -29 +31 @@ When prompted for confirmation, enter `delete`, and then choose **Delete**. The - 8. For **Target type** , choose the type of the traffic mirror target: + 7. For **Target type** , choose the type of the traffic mirror target: @@ -37 +39 @@ When prompted for confirmation, enter `delete`, and then choose **Delete**. The - 9. For **Target** , choose the traffic mirror target. We display targets based on the target type that you selected in the previous step. + 8. For **Target** , choose the destination resource. We display resources based on the target type that you selected in the previous step. @@ -39 +41 @@ When prompted for confirmation, enter `delete`, and then choose **Delete**. The - 10. (Optional) For each tag to add, choose **Add new tag** and enter the tag key and tag value. + 9. (Optional) For each tag to add, choose **Add new tag** and enter the tag key and tag value. @@ -41 +43 @@ When prompted for confirmation, enter `delete`, and then choose **Delete**. The - 11. Choose **Create**. + 10. Choose **Create**. @@ -46 +48 @@ When prompted for confirmation, enter `delete`, and then choose **Delete**. The -After you create a target, assign it to a traffic mirror session. For more information, see [Create, modify, or delete a traffic mirror session](./create-traffic-mirroring-session.html). +###### To create a traffic mirror target using the AWS CLI @@ -48 +50,11 @@ After you create a target, assign it to a traffic mirror session. For more infor -You must configure a security group for the traffic mirror target that allows VXLAN traffic (UDP port 4789) from the traffic mirror source. +Use the [create-traffic-mirror-target](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-traffic-mirror-target.html) command. + +###### To delete a traffic mirror target using the console + + 1. Open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). + + 2. On the navigation pane, choose **Traffic Mirroring** , **Mirror targets**. + + 3. Select the traffic mirror target and choose **Delete**. + + 4. When prompted for confirmation, enter `delete`, and then choose **Delete**. @@ -50 +61,0 @@ You must configure a security group for the traffic mirror target that allows VX -You can share a traffic mirror target across accounts. For more information, see [Share a traffic mirror target](./tm-sharing.html). @@ -52 +62,0 @@ You can share a traffic mirror target across accounts. For more information, see -###### To create a traffic mirror target using the AWS CLI @@ -54 +63,0 @@ You can share a traffic mirror target across accounts. For more information, see -Use the [create-traffic-mirror-target](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-traffic-mirror-target.html) command.