AWS AmazonS3 documentation change
Summary
Added documentation for dual-stack endpoints (IPv6) support in VPC configurations for S3 Tables, including requirements for security groups, VPC CIDR blocks, IAM policies, and CLI commands to enable dual-stack connectivity.
Security assessment
The changes introduce guidance for IPv6 network security configurations (e.g., updating security group rules to allow HTTPS over IPv6, modifying IAM policies for IPv6 addresses). While these are security-related best practices, there is no evidence this addresses an existing vulnerability. The changes primarily document a new feature (dual-stack support) and associated security considerations.
Diff
diff --git a/AmazonS3/latest/userguide/s3-tables-VPC.md b/AmazonS3/latest/userguide/s3-tables-VPC.md index 76a141a29..e0cf0bb71 100644 --- a//AmazonS3/latest/userguide/s3-tables-VPC.md +++ b//AmazonS3/latest/userguide/s3-tables-VPC.md @@ -5 +5 @@ -Creating VPC endpointsAccessing S3 Tables endpoints with the AWS CLIConfiguring a VPC network when using query enginesRestricting access to S3 Tables within the VPC network +Creating VPC endpointsAccessing S3 Tables endpoints with the AWS CLIConfiguring a VPC network when using query enginesDual-stack endpointsRestricting access to S3 Tables within the VPC network @@ -24,0 +25,2 @@ To learn more about using AWS PrivateLink to create and work with endpoints for + * Using the dual-stack endpoints to access tables and table buckets + @@ -45,4 +46,0 @@ You can also use Private DNS options to simplify routing S3 traffic over VPC end -###### Note - -AWS PrivateLink for Amazon S3 doesn't support using Amazon S3 dual-stack endpoints. For more information, see [Using Amazon S3 dual-stack endpoints](https://docs.aws.amazon.com/AmazonS3/latest/API/dual-stack-endpoints.html) in the _Amazon S3 API Reference_. - @@ -91,0 +90,44 @@ Use the following steps to configure a VPC network when using query engines. +## Using the dual-stack endpoints to access tables and table buckets + +S3 Tables supports dual-stack connectivity for AWS PrivateLink. Dual-stack endpoints allow you to access S3 tables buckets using the Internet Protocol version 6 (IPv6), in addition to the IPv4 protocol, depending on what your network supports. You can access an S3 bucket through a dual-stack endpoint using the following naming convention: + + + s3tables.<region>.api.aws + +The following are some things you should know before trying to access S3 tables and table buckets over IPv6 in your VPC: + + * The client you use to access tables and your S3 client must both have dual-stack enabled. + + * IPv6 inbound is not enabled by default for VPC security groups. To allow IPv6 access you will need to add a new rule allowing HTTPS (TCP port 443) to your security group. For more information, see [_Configure security group rules_](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/changing-security-group.html#add-remove-security-group-rules) in the _Amazon EC2user guide_ + + * If your VPC doesn't have IPv6 CIDRs assigned, you will need to manually add an IPv6 CIDR block to your VPC. For more info, see [_Add IPv6 support for your VPC_](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-migrate-ipv6-add.html) in the _AWS PrivateLink user guide_ + + * If you use IP address filtering IAM policies they must be updated to handle IPv6 addresses. For more information about managing access permissions with IAM, see [Identity and Access Management for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-iam.html). + + + + +To create a new VPC endpoint that uses the dual-stack endpoint for S3 Tables use example CLI command: + + + aws ec2 create-vpc-endpoint \ + --vpc-id vpc-id \ + --service-name com.amazonaws.aws-region.s3tables \ + --subnet-ids subnet-1 subnet-2 \ + --vpc-endpoint-type Interface \ + --ip-address-type dualstack \ + --dns-options "DnsRecordIpType=dualstack" \ + --security-group-ids sg-id \ + --region aws-region + +For more information on creating VPC endpoints see [_Create an interface endpoint_](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) in the VPC user guide. + +If your network supports IPv6 and you want to update your VPC to enable IPv6 you can use the following CLI command: + + + aws ec2 modify-vpc-endpoint \ + --vpc-endpoint-id vpce-id \ + --ip-address-type dualstack \ + --dns-options "DnsRecordIpType=dualstack" \ + --region aws-region +