AWS AmazonS3 documentation change
Summary
Updated networking documentation for S3 directory buckets to include dual-stack endpoints, clarify route table selection, add IP address type configuration, and emphasize VPC endpoint security practices.
Security assessment
The changes add guidance about restricting access via VPC endpoints and reference AWS Management Console Private Access, which improves security documentation. However, there is no evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/AmazonS3/latest/userguide/directory-bucket-az-networking.md b/AmazonS3/latest/userguide/directory-bucket-az-networking.md index 99f4518cc..8ea100002 100644 --- a//AmazonS3/latest/userguide/directory-bucket-az-networking.md +++ b//AmazonS3/latest/userguide/directory-bucket-az-networking.md @@ -9 +9 @@ Endpoints for directory buckets in Availability ZonesConfiguring VPC gateway end -The following topics describe the networking requirements for accessing S3 Express One Zone by using a gateway VPC endpoint. +To reduce the amount of time your packets spend on the network, configure your virtual private cloud (VPC) with a gateway endpoint to access directory buckets in Availability Zones while keeping traffic within the AWS network, and at no additional cost. @@ -26,7 +26,7 @@ Region name | Region | Availability Zone IDs | Regional endpoint | Zonal endpoin -US East (N. Virginia) | `us-east-1` | `use1-az4` `use1-az5` `use1-az6` | `s3express-control.us-east-1.amazonaws.com` | `s3express-use1-az4.us-east-1.amazonaws.com` `s3express-use1-az5.us-east-1.amazonaws.com` `s3express-use1-az6.us-east-1.amazonaws.com` -US East (Ohio) | `us-east-2` | `use2-az1` `use2-az2` | `s3express-control.us-east-2.amazonaws.com` | `s3express-use2-az1.us-east-2.amazonaws.com` `s3express-use2-az2.us-east-2.amazonaws.com` -US West (Oregon) | `us-west-2` | `usw2-az1` `usw2-az3` `usw2-az4` | `s3express-control.us-west-2.amazonaws.com` | `s3express-usw2-az1.us-west-2.amazonaws.com` `s3express-usw2-az3.us-west-2.amazonaws.com` `s3express-usw2-az4.us-west-2.amazonaws.com` -Asia Pacific (Mumbai) | `ap-south-1` | `aps1-az1` `aps1-az3` | `s3express-control.ap-south-1.amazonaws.com` | `s3express-aps1-az1.ap-south-1.amazonaws.com` `s3express-aps1-az3.ap-south-1.amazonaws.com` -Asia Pacific (Tokyo) | `ap-northeast-1` | `apne1-az1` `apne1-az4` | `s3express-control.ap-northeast-1.amazonaws.com` | `s3express-apne1-az1.ap-northeast-1.amazonaws.com` `s3express-apne1-az4.ap-northeast-1.amazonaws.com` -Europe (Ireland) | `eu-west-1` | `euw1-az1` `euw1-az3` | `s3express-control.eu-west-1.amazonaws.com` | `s3express-euw1-az1.eu-west-1.amazonaws.com` `s3express-euw1-az3.eu-west-1.amazonaws.com` -Europe (Stockholm) | `eu-north-1` | `eun1-az1` `eun1-az2` `eun1-az3` | `s3express-control.eu-north-1.amazonaws.com` | `s3express-eun1-az1.eu-north-1.amazonaws.com` `s3express-eun1-az2.eu-north-1.amazonaws.com` `s3express-eun1-az3.eu-north-1.amazonaws.com` +US East (N. Virginia) | `us-east-1` | `use1-az4` `use1-az5` `use1-az6` | `s3express-control.us-east-1.amazonaws.com` `s3express-control-dualstack.us-east-1.amazonaws.com ` | `s3express-use1-az4.us-east-1.amazonaws.com` `s3express-use1-az4.dualstack.us-east-1.amazonaws.com` `s3express-use1-az5.us-east-1.amazonaws.com` `s3express-use1-az5.dualstack.us-east-1.amazonaws.com` `s3express-use1-az6.us-east-1.amazonaws.com` `s3express-use1-az6.dualstack.us-east-1.amazonaws.com` +US East (Ohio) | `us-east-2` | `use2-az1` `use2-az2` | `s3express-control.us-east-2.amazonaws.com` `s3express-control-dualstack.us-east-2.amazonaws.com` | `s3express-use2-az1.us-east-2.amazonaws.com` `s3express-use2-az1.dualstack.us-east-2.amazonaws.com` `s3express-use2-az2.us-east-2.amazonaws.com` `s3express-use2-az2.dualstack.us-east-2.amazonaws.com` +US West (Oregon) | `us-west-2` | `usw2-az1` `usw2-az3` `usw2-az4` | `s3express-control.us-west-2.amazonaws.com` `s3express-control-dualstack.us-west-2.amazonaws.com` | `s3express-usw2-az1.us-west-2.amazonaws.com` `s3express-usw2-az1.dualstack.us-west-2.amazonaws.com` `s3express-usw2-az3.us-west-2.amazonaws.com` `s3express-usw2-az3.dualstack.us-west-2.amazonaws.com` `s3express-usw2-az4.us-west-2.amazonaws.com` `s3express-usw2-az4.dualstack.us-west-2.amazonaws.com` +Asia Pacific (Mumbai) | `ap-south-1` | `aps1-az1` `aps1-az3` | `s3express-control.ap-south-1.amazonaws.com` `s3express-control-dualstack.ap-south-1.amazonaws.com` | `s3express-aps1-az1.ap-south-1.amazonaws.com` `s3express-aps1-az1.dualstack.ap-south-1.amazonaws.com` `s3express-aps1-az3.ap-south-1.amazonaws.com` `s3express-aps1-az3.dualstack.ap-south-1.amazonaws.com` +Asia Pacific (Tokyo) | `ap-northeast-1` | `apne1-az1` `apne1-az4` | `s3express-control.ap-northeast-1.amazonaws.com` `s3express-control-dualstack.ap-northeast-1.amazonaws.com` | `s3express-apne1-az1.ap-northeast-1.amazonaws.com` `s3express-apne1-az1.dualstack.ap-northeast-1.amazonaws.com` `s3express-apne1-az4.ap-northeast-1.amazonaws.com` `s3express-apne1-az4.dualstack.ap-northeast-1.amazonaws.com` +Europe (Ireland) | `eu-west-1` | `euw1-az1` `euw1-az3` | `s3express-control.eu-west-1.amazonaws.com` `s3express-control-dualstack.eu-west-1.amazonaws.com` | `s3express-euw1-az1.eu-west-1.amazonaws.com` `s3express-euw1-az1.dualstack.eu-west-1.amazonaws.com` `s3express-euw1-az3.eu-west-1.amazonaws.com` `s3express-euw1-az3.dualstack.eu-west-1.amazonaws.com` +Europe (Stockholm) | `eu-north-1` | `eun1-az1` `eun1-az2` `eun1-az3` | `s3express-control.eu-north-1.amazonaws.com` `s3express-control-dualstack.eu-north-1.amazonaws.com` | `s3express-eun1-az1.eu-north-1.amazonaws.com` `s3express-eun1-az1.dualstack.eu-north-1.amazonaws.com` `s3express-eun1-az2.eu-north-1.amazonaws.com` `s3express-eun1-az2.dualstack.eu-north-1.amazonaws.com` `s3express-eun1-az3.eu-north-1.amazonaws.com` `s3express-eun1-az3.dualstack.eu-north-1.amazonaws.com` @@ -54 +54 @@ Use the following procedure to create a gateway endpoint that connects to Amazon - 8. For **Route tables** , select the route tables to be used by the endpoint. Amazon VPC automatically adds a route that points traffic destined for the service to the endpoint network interface. + 8. For **Route tables** , choose the route table on your Local Zone to be used by the endpoint. After the endpoint is created, a route record will be added to the route table that you select in this step. @@ -56 +56 @@ Use the following procedure to create a gateway endpoint that connects to Amazon - 9. For **Policy** , choose **Full access** to allow all operations by all principals on all resources over the VPC endpoint. Otherwise, choose **Custom** to attach a VPC endpoint policy that controls the permissions that principals have to perform actions on resources over the VPC endpoint. + 9. For **Policy** , choose **Full access** to allow all operations by all principals on all resources over the VPC endpoint. Otherwise, choose **Custom** to attach a VPC endpoint policy that controls the principals' permissions to perform actions on resources over the VPC endpoint. @@ -58 +58 @@ Use the following procedure to create a gateway endpoint that connects to Amazon - 10. (Optional) To add a tag, choose **Add new tag** , and enter the tag key and the tag value. + 10. For **IP address type** , choose from the following options: @@ -60 +60,9 @@ Use the following procedure to create a gateway endpoint that connects to Amazon - 11. Choose **Create endpoint**. + * **IPv4** – Assign IPv4 addresses to the endpoint network interfaces. This option is supported only if all selected subnets have IPv4 address ranges and the service accepts IPv4 requests. + + * **IPv6** – Assign IPv6 addresses to the endpoint network interfaces. This option is supported only if all selected subnets are IPv6 only subnets and the service accepts IPv6 requests. + + * **Dualstack** – Assign both IPv4 and IPv6 addresses to the endpoint network interfaces. This option is supported only if all selected subnets have both IPv4 and IPv6 address ranges and the service accepts both IPv4 and IPv6 requests. + + 11. (Optional) To add a tag, choose **Add new tag** , and enter the tag key and the tag value. + + 12. Choose **Create endpoint**. @@ -66,0 +75,6 @@ After creating a gateway endpoint, you can use Regional API endpoints and Zonal +To learn more about gateway VPC endpoints, see [Gateway endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html) in the _AWS PrivateLink Guide_. For the data residency use cases, we recommend enabling access to your buckets only from your VPC using gateway VPC endpoints. When access is restricted to a VPC or a VPC endpoint, you can access the objects through the AWS Management Console, the REST API, AWS CLI, and AWS SDKs. + +###### Note + +To restrict access to a VPC or a VPC endpoint using the AWS Management Console, you must use the AWS Management Console Private Access. For more information, see [AWS Management Console Private Access](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/console-private-access.html) in the _AWS Management Console guide_ AWS Management Console guide. +