AWS workspaces documentation change
Summary
Updated VPC endpoint configuration documentation to add IPv6 support, clarify DNS requirements, and adjust service name references.
Security assessment
The changes emphasize using private DNS servers within the VPC to resolve endpoint names (since public DNS won't work), which helps prevent accidental exposure of internal resources. This adds security documentation but does not directly address a specific vulnerability. The IPv6 support expansion improves configuration clarity but isn't tied to a disclosed security issue.
Diff
diff --git a/workspaces/latest/adminguide/creating-streaming-vpc-endpoints.md b/workspaces/latest/adminguide/creating-streaming-vpc-endpoints.md index e2f5e064e..364ff02ee 100644 --- a//workspaces/latest/adminguide/creating-streaming-vpc-endpoints.md +++ b//workspaces/latest/adminguide/creating-streaming-vpc-endpoints.md @@ -18,0 +19,6 @@ Before you set up VPC endpoints for WorkSpaces, be aware of the following prereq + * The feature currently supports IPv4 or IPv6 DNS record IP type. Dualstack DNS record IP type is not supported. + + * You can only configure VPC endpoints that are in the same AWS account as your directory. VPC endpoints in other AWS accounts are not supported, including endpoints in shared VPCs. + + * The feature currently only support private DNS name for VPC endpoints. The private DNS name for a VPC endpoint is not publicly resolvable. + @@ -23,2 +28,0 @@ Before you set up VPC endpoints for WorkSpaces, be aware of the following prereq - * The feature currently only supports IPv4 VPC endpoints. IPv6 and Dualstack VPC endpoints are not supported. - @@ -82 +86 @@ In this step, you create a security group that lets WorkSpaces clients communica - * For **Source** – Enter the private IP CIDR range or other Security Group IDs from which your users connect to the VPC endpoint. Make sure to allow inbound traffic from IPv4 address source only. + * For **Source** – Enter the private IP CIDR range or other Security Group IDs from which your users connect to the VPC endpoint. Make sure to allow inbound traffic from an IPv4 or IPv6 address source. @@ -96 +100 @@ In this step, you create a security group that lets WorkSpaces clients communica - * For **Source** – Enter the same private IP CIDR range or Security Group IDs entered in Step 5. + * For **Source** – Enter the same private IP CIDR range or Security Group IDs entered in Step 5. Make sure to allow inbound traffic from an IPv4 or IPv6 address source. @@ -98 +102 @@ In this step, you create a security group that lets WorkSpaces clients communica - 9. Repeat steps 7 and 8 for each custom UDP. + 9. Repeat steps 7 and 8 for each CIDR range or Security Group. @@ -119 +123 @@ In Amazon VPC, a VPC endpoint lets you connect your VPC to supported AWS service - * **Service Name** – Choose **com.amazonaws.`Region`.prod.highlander**. + * **Service Name** – Choose **com.amazonaws.`Region`.highlander**. @@ -123 +127 @@ In Amazon VPC, a VPC endpoint lets you connect your VPC to supported AWS service - * **Enable Private DNS Name** – The check box is selected. If your users use a network proxy to access streaming instances, disable any proxy caching on the domain and DNS names that are associated with the private endpoint. The VPC endpoint DNS name should be allowed through the proxy. + * **Enable Private DNS Name** – The check box is selected. If your users use a network proxy to access streaming instances, disable any proxy caching on the domain and DNS names that are associated with the private endpoint. The VPC endpoint DNS name should be allowed through the proxy. For successful DNS name resolution, it is essential to use the private DNS servers within the VPC, this is because public DNS servers will not resolve the VPC endpoint DNS name. @@ -125 +129 @@ In Amazon VPC, a VPC endpoint lets you connect your VPC to supported AWS service - * **DNS record IP type** – Choose IPv4. Dualstack and IPv6 DNS record IP type are currently not supported. If Dualstack or IPv6 is selected, you won’t be able to stream from WorkSpaces using the VPC endpoint. + * **DNS record IP type** – Choose IPv4 or IPv6. Dualstack DNS record IP type is currently not supported. If you choose Dualstack, you won’t be able to stream from WorkSpaces using the VPC endpoint. @@ -129 +133 @@ In Amazon VPC, a VPC endpoint lets you connect your VPC to supported AWS service - * **IP address type** – Choose IPv4. + * **IP address type** – Choose IPv4, IPv6 or Dualstack depending on what the Subnets you chose support.