AWS vpc-lattice documentation change
Summary
Expanded documentation for creating resource configurations with added details about custom domain verification, access logging, and AWS CLI examples
Security assessment
Added documentation for domain verification IDs to prove ownership, which is a security control to prevent unauthorized domain usage. However, there is no evidence this addresses an existing vulnerability - it appears to document standard security practices for domain validation.
Diff
diff --git a/vpc-lattice/latest/ug/create-resource-configuration.md b/vpc-lattice/latest/ug/create-resource-configuration.md index 87c44d401..041d7a032 100644 --- a//vpc-lattice/latest/ug/create-resource-configuration.md +++ b//vpc-lattice/latest/ug/create-resource-configuration.md @@ -7 +7,4 @@ -Use the console to create a resource configuration. +Create a resource configuration. + +AWS Management Console + @@ -23 +26,26 @@ Use the console to create a resource configuration. - 7. Choose the identifier for the resource that you want this resource configuration to represent. + 7. (Optional) To enter a custom domain name, do one of the following: + + * If you have a resource configuration of type single, you can enter a custom domain name. Resource consumers can use this domain name to access your resource configurations. + + * If you have a resource configuration of type group and child, you must first specify a group domain on the group resource configuration. Next, the child resource configurations can have custom domains that are subdomains of the group domain. + + 8. (Optional) Enter the verification ID. + +Provide a verification ID if you want your domain name to be verified. This lets resource consumers know that you own the domain name. + + 9. Choose the identifier for the resource that you want this resource configuration to represent. + + 10. Choose the port ranges through which you want to share the resource. + + 11. For **Association settings** , specify whether this resource configuration can be associated with shareable service networks. + + 12. For **Share resource configuration** , choose the resource shares that identify the principals who can access this resource. + + 13. (Optional) For **Monitoring** , enable **Resource access logs** and the delivery destination if you want to monitor requests and responses to and from the resource configuration. + + 14. (Optional) To add a tag, choose **Add new tag** and enter the tag key and the tag value. + + 15. Choose **Create resource configuration**. + + + @@ -25 +53 @@ Use the console to create a resource configuration. - 8. Choose the port ranges through which you want to share the resource. +AWS CLI @@ -27 +54,0 @@ Use the console to create a resource configuration. - 9. For **Association settings** , specify whether this resource configuration can be associated with shareable service networks. @@ -29 +56 @@ Use the console to create a resource configuration. - 10. For **Share resource configuration** , choose the resource shares that identify the principals who can access this resource. +The following [create-resource-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/vpc-lattice/create-resource-configuration.html) command creates a single resource configuration and associates it with the custom domain name `example.com`. @@ -31 +57,0 @@ Use the console to create a resource configuration. - 11. (Optional) For **Monitoring** , enable **Resource access logs** and the delivery destination if you want to monitor requests and responses to and from the resource configuration. @@ -33 +59,7 @@ Use the console to create a resource configuration. - 12. (Optional) To add a tag, choose **Add new tag** and enter the tag key and the tag value. + aws vpc-lattice create-resource-configuration \ + --name my-resource-config \ + --type SINGLE \ + --resource-gateway-identifier rgw-0bba03f3d56060135 \ + --resource-configuration-definition 'ipResource={ipAddress=10.0.14.85}' \ + --custom-domain-name example.com \ + --verification-id dv-aaaa0000000111111 @@ -35 +67 @@ Use the console to create a resource configuration. - 13. Choose **Create resource configuration**. +The following [create-resource-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/vpc-lattice/create-resource-configuration.html) command creates a group resource configuration and associates it with the custom domain name `example.com`. @@ -37,0 +70,5 @@ Use the console to create a resource configuration. + aws vpc-lattice-custom-dns create-resource-configuration \ + --name my-custom-dns-resource-config-group \ + --type GROUP \ + --resource-gateway-identifier rgw-0bba03f3d56060135 \ + --domain-verification-identifier dv-aaaa0000000111111 @@ -38,0 +76 @@ Use the console to create a resource configuration. +The following [create-resource-configuration](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/vpc-lattice/create-resource-configuration.html) command creates a child resource configuration and associates it with the custom domain name `child.example.com`. @@ -40 +77,0 @@ Use the console to create a resource configuration. -###### To create a resource configuration using the AWS CLI @@ -42 +79,6 @@ Use the console to create a resource configuration. -Use the [create-resource-configuration](https://docs.aws.amazon.com/cli/latest/reference/vpc-lattice/create-resource-configuration.html) command. + aws vpc-lattice-custom-dns create-resource-configuration \ + --name my-custom-dns-resource-config-child \ + --type CHILD \ + --resource-configuration-definition 'dnsResource={domainName=my-alb-123456789.us-west-2.elb.amazonaws.com,ipAddressType=IPV4}' \ + --resource-configuration-group-identifier rcfg-07129f3acded87626 \ + --custom-domain-name child.example.com @@ -50 +92 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Resource configurations +Create and verify a domain