AWS vpc-lattice documentation change
Summary
Updated documentation for managing service network resource associations and VPC endpoint associations, including new steps for enabling private DNS names and revised CLI examples
Security assessment
The changes introduce documentation about enabling private DNS names and configuring DNS preferences, which relates to secure network communication. However, there is no evidence this addresses an existing security vulnerability - rather it documents security-adjacent configuration options.
Diff
diff --git a/vpc-lattice/latest/ug/resource-configuration-associations.md b/vpc-lattice/latest/ug/resource-configuration-associations.md index 54a57fd07..17335fbb2 100644 --- a//vpc-lattice/latest/ug/resource-configuration-associations.md +++ b//vpc-lattice/latest/ug/resource-configuration-associations.md @@ -5 +5 @@ -Manage service network associationsManage VPC endpoint associations +Manage service network resource associationsManage resource VPC endpoint associations @@ -9 +9 @@ Manage service network associationsManage VPC endpoint associations -Consumer accounts with which you share a resource configuration with and clients in your account can access the resource configuration either directly using a VPC endpoint of type resource or through a VPC endpoint of type service-network. As a result your resource configuration will have endpoint associations and service network associations. +Consumer accounts with which you share a resource configuration with and clients in your account can access the resource configuration either directly using a VPC endpoint of type resource or through a VPC endpoint of type service-network. As a result, your resource configuration will have endpoint associations and service network associations. @@ -11 +11 @@ Consumer accounts with which you share a resource configuration with and clients -## Manage service network associations +## Manage service network resource associations @@ -35 +35 @@ If you receive an access-denied message while creating the association between t - 8. Choose **Save changes**. + 8. (Optional) To enable private DNS names for this service network resource association choose **enable private DNS name**. For more information, see [Custom domain names for service network owners](./resource-configuration.html#resource-configuration-custom-domain-name-service-network-owners). @@ -37 +37,3 @@ If you receive an access-denied message while creating the association between t - 9. To delete an association, select the check box for the association and then choose **Actions** , **Delete**. When prompted for confirmation, enter `confirm` and then choose **Delete**. + 9. Choose **Save changes**. + + 10. To delete an association, select the check box for the association and then choose **Actions** , **Delete**. When prompted for confirmation, enter `confirm` and then choose **Delete**. @@ -50 +52 @@ Use the [delete-service-network-resource-association](https://docs.aws.amazon.co -## Manage VPC endpoint associations +## Manage resource VPC endpoint associations @@ -52 +54 @@ Use the [delete-service-network-resource-association](https://docs.aws.amazon.co -Manage a VPC endpoint association. +Consumer accounts with access to your resource configuration or clients in your account can access the resource configuration using a resource VPC endpoint. If your resource configuration has a custom domain name, you can use enable private DNS to allow VPC Lattice to provision private hosted zones for your resource endpoint or service-network endpoint. With this, clients can directly curl the domain name to access the resource configuration. For more information, see [Custom domain names for resource consumers](./resource-configuration.html#custom-domain-name-resource-consumers). @@ -54 +56 @@ Manage a VPC endpoint association. -###### To manage a VPC endpoint association using the console +AWS Management Console @@ -56 +57,0 @@ Manage a VPC endpoint association. - 1. Open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). @@ -58 +59 @@ Manage a VPC endpoint association. - 2. In the navigation pane, under **PrivateLink and Lattice** , choose **Resource configurations**. + 1. To create a new endpoint association, go to **PrivateLink and Lattice** in the left navigation pane and choose **Endpoints**. @@ -60 +61,5 @@ Manage a VPC endpoint association. - 3. Select the name of the resource configuration to open its details page. + 2. Choose **Create endpoints**. + + 3. Select the resource configuration you want to connect to your VPC. + + 4. Select the VPC, subnets and security groups. @@ -62 +67 @@ Manage a VPC endpoint association. - 4. Choose the **Endpoint associations** tab. + 5. (Optional) To turn on private DNS and configure DNS options, select **Enable private DNS name**. @@ -64 +69 @@ Manage a VPC endpoint association. - 5. Select the association ID to open its details page. From here, you can modify or delete the association. + 6. (Optional) To tag you VPC endpoint, choose **Add new tag** , and enter a tag key and tag value. @@ -66 +71 @@ Manage a VPC endpoint association. - 6. To create a new endpoint association, go to **PrivateLink and Lattice** in the left navigation pane and choose **Endpoints**. + 7. Choose **Create endpoint**. @@ -68 +72,0 @@ Manage a VPC endpoint association. - 7. Choose **Create endpoints**. @@ -70 +73,0 @@ Manage a VPC endpoint association. - 8. Select the resource configuration you want to connect to your VPC. @@ -72 +74,0 @@ Manage a VPC endpoint association. - 9. Select the VPC, subnets and security groups. @@ -74 +76 @@ Manage a VPC endpoint association. - 10. (Optional) To tag you VPC endpoint, choose **Add new tag** , and enter a tag key and tag value. +AWS CLI @@ -76 +77,0 @@ Manage a VPC endpoint association. - 11. Choose **Create endpoint**. @@ -77,0 +79 @@ Manage a VPC endpoint association. +The following [create-vpc-endpoint](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-vpc-endpoint.html) command creates a VPC endpoint that uses private DNS. The private DNS preferences are set to `VERIFIED_AND_SELECTED` and the selected domains are `example.com` and `example.org`. VPC Lattice only provisions private hosted zones for any verified domains or `example.com` or `example.org`. @@ -79,0 +82,8 @@ Manage a VPC endpoint association. + aws ec2 create-vpc-endpoint \ + --vpc-endpoint-type Resource \ + --vpc-id vpc-111122223333aabbc \ + --subnet-ids subnet-0011aabbcc2233445 \ + --resource-configuration-arn arn:aws:vpc-lattice:us-west-2:111122223333:resourceconfiguration/rcfg-07129f3acded87625 \ + --private-dns-enabled \ + --private-dns-preferences VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS \ + --private-domains-set example.com, example.org