AWS vpc-lattice medium security documentation change
Summary
Updated documentation to clarify DNS configuration hierarchy and add detailed private DNS management options for service network associations. Added explicit steps for configuring private DNS preferences in resource/VPC associations.
Security assessment
The changes explicitly document how private DNS configuration at the resource association level overrides other settings, which prevents unintended DNS provisioning. Added controls for domain allowlisting ('Verified and specified domains') help prevent DNS hijacking by restricting hosted zone creation to approved domains. These changes address potential misconfiguration risks that could lead to DNS-based attacks.
Diff
diff --git a/vpc-lattice/latest/ug/service-network-associations.md b/vpc-lattice/latest/ug/service-network-associations.md index 9fd7974f1..71beab787 100644 --- a//vpc-lattice/latest/ug/service-network-associations.md +++ b//vpc-lattice/latest/ug/service-network-associations.md @@ -5 +5 @@ -Manage service associationsManage resource configuration associationsManage VPC associationsManage VPC endpoint associations +Manage service network service associationsManage service network resource associationsManage service network VPC associations Manage service network VPC endpoint associations @@ -10,0 +11,4 @@ When you associate a service or a resource configuration with the service networ +The private DNS enabled property of the service network resource association overrides the private DNS enabled property of the service network endpoint and the service network VPC association. + +If a service network owner creates a service network resource association and doesn't enable private DNS, VPC Lattice won’t provision private hosted zones for that resource configuration in any VPCs that the service network is connected to, even though private DNS is enabled on the service network endpoint or service network VPC associations. + @@ -13 +17 @@ When you associate a service or a resource configuration with the service networ - * Manage service associations + * Manage service network service associations @@ -15 +19 @@ When you associate a service or a resource configuration with the service networ - * Manage resource configuration associations + * Manage service network resource associations @@ -17 +21 @@ When you associate a service or a resource configuration with the service networ - * Manage VPC associations + * Manage service network VPC associations @@ -19 +23 @@ When you associate a service or a resource configuration with the service networ - * Manage VPC endpoint associations + * Manage service network VPC endpoint associations @@ -24 +28 @@ When you associate a service or a resource configuration with the service networ -## Manage service associations +## Manage service network service associations @@ -63 +67 @@ Use the [delete-service-network-service-association](https://docs.aws.amazon.com -## Manage resource configuration associations +## Manage service network resource associations @@ -85 +89 @@ You can create or delete the association between the service network and resourc - 2. Select a resource configuration from **Resource configurations**. Choose **Create an Amazon VPC Lattice resource configuration.**. + 2. For **Resource configurations** , select a resource configuration. @@ -87 +91 @@ You can create or delete the association between the service network and resourc - 3. (Optional) To add a tag, expand **Service association tags** , choose **Add new tag** , and enter a tag key and tag value. + 3. For **DNS name** , select **Private DNS enabled** to allow VPC Lattice to provision a private hosted zone for your resource configuration associations based on the domain name of the resource configuration. @@ -89 +93,3 @@ You can create or delete the association between the service network and resourc - 4. Choose **Save changes**. + 4. (Optional) To add a tag, expand **Service association tags** , choose **Add new tag** , and enter a tag key and tag value. + + 5. Choose **Save changes**. @@ -104 +110 @@ Use the [delete-service-network-resource-association](https://docs.aws.amazon.co -## Manage VPC associations +## Manage service network VPC associations @@ -109,0 +116,2 @@ Associating a VPC is an optional step when you create a service network. Network +When you create a VPC association to a resource configuration, you can specify the private DNS preference. This preference allows VPC Lattice to provision private hosted zones on the resource consumer's behalf. For more information, see [Custom domain names for resource providers](./resource-configuration.html#custom-domain-name-resource-providers). + @@ -130 +138 @@ When you a delete a VPC association, clients in the VPCs can no longer connect t - 4. (Optional) To add a tag, expand **VPC association tags** , choose **Add new tag** , and enter a tag key and tag value. + 4. (Optional) To allow VPC Lattice to provision a private hosted zone based on the domain name of a resource configuration, for **DNS name** , select **Enable DNS name** and do the following: @@ -132 +140,9 @@ When you a delete a VPC association, clients in the VPCs can no longer connect t - 5. Choose **Save changes**. + 1. For **Private DNS preference** , select a preference. + +If you choose **All domains** , VPC Lattice provisions a private hosted zone for any custom domain name for a resource configuration. + + 2. (Optional) If you choose **Verified and specified domains** or **Specified domains** , enter a comma separated list of domains that you want VPC Lattice to provision hosted zones for. VPC Lattice only provisions a hosted zone if it matches your private domains list. You can use wildcard matching. + + 5. (Optional) To add a tag, expand **VPC association tags** , choose **Add new tag** , and enter a tag key and tag value. + + 6. Choose **Save changes**. @@ -153 +169 @@ Use the [delete-service-network-vpc-association](https://docs.aws.amazon.com/cli -## Manage VPC endpoint associations +## Manage service network VPC endpoint associations @@ -156,0 +173,2 @@ Clients can send requests to services and resources specified in resource config +When you create a VPC association to a resource configuration, you can specify the private DNS preference. This preference allows VPC Lattice to provision private hosted zones on the resource consumer's behalf. For more information, see [Custom domain names for resource providers](./resource-configuration.html#custom-domain-name-resource-providers). + @@ -186 +204,3 @@ Clients can send requests to services and resources specified in resource config - 7. (Optional) To add a tag, expand **VPC association tags** , choose **Add new tag** , and enter a tag key and tag value. + 7. (Optional) To enable private DNS, choose **Enable private DNS**. + + 8. (Optional) To add a tag, expand **VPC association tags** , choose **Add new tag** , and enter a tag key and tag value. @@ -188 +208 @@ Clients can send requests to services and resources specified in resource config - 8. Choose **Create endpoint**. + 9. Choose **Create endpoint**.