AWS AmazonS3 documentation change
Summary
Added documentation for IP address types (IPv4/IPv6/Dual-stack) and DNS record IP types for VPC endpoints, including configuration details and routing considerations
Security assessment
The changes add security-relevant documentation about proper DNS/IP configuration to prevent unintended traffic routing (e.g., warnings about IPv6 traffic potentially being routed over internet gateways if misconfigured). While not addressing a specific vulnerability, they provide security guidance for network isolation.
Diff
diff --git a/AmazonS3/latest/userguide/privatelink-interface-endpoints.md b/AmazonS3/latest/userguide/privatelink-interface-endpoints.md index b4effe5a8..df2dab893 100644 --- a//AmazonS3/latest/userguide/privatelink-interface-endpoints.md +++ b//AmazonS3/latest/userguide/privatelink-interface-endpoints.md @@ -5 +5 @@ -Types of VPC endpointsRestrictions and limitations of AWS PrivateLink for Amazon S3Creating a VPC endpointAccessing Amazon S3 interface endpointsPrivate DNSAccessing buckets, access points, and Amazon S3 Control API operations from S3 interface endpointsUpdating an on-premises DNS configurationCreating a VPC endpoint policy +Types of VPC endpointsRestrictions and limitations of AWS PrivateLink for Amazon S3Creating a VPC endpointAccessing Amazon S3 interface endpointsIP Address types for VPC endpointsDNS record IP types for VPC endpointsPrivate DNSAccessing buckets, access points, and Amazon S3 Control API operations from S3 interface endpointsUpdating an on-premises DNS configurationCreating a VPC endpoint policy @@ -24,0 +25,4 @@ For general information about interface endpoints, see [Interface VPC endpoints + * IP Address types for VPC endpoints + + * DNS record IP types for VPC endpoints + @@ -51 +55 @@ Not billed | Billed -For more information about gateway endpoints, see [Gateway VPC endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-gateway.html) in the _AWS PrivateLink Guide_. +For more information, see [Gateway endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html) and [interface VPC endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) in the _AWS PrivateLink Guide_. @@ -57 +61 @@ VPC limitations apply to AWS PrivateLink for Amazon S3. For more information, se -AWS PrivateLink for Amazon S3 does not support the following: +Interface endpoints for Amazon S3 does not support the following: @@ -67,2 +70,0 @@ AWS PrivateLink for Amazon S3 does not support the following: - * [Dual-stack endpoints ](https://docs.aws.amazon.com/AmazonS3/latest/API/dual-stack-endpoints.html) - @@ -82 +84 @@ AWS PrivateLink for Amazon S3 does not support the following: -To create a VPC interface endpoint, see [ Create a VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint-aws) in the _AWS PrivateLink Guide_. +To create a VPC interface endpoint, see [ Create a VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint-aws) in the _AWS PrivateLink Guide_. To create a VPC gateway endpoint, see [Create a gateway endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html#create-gateway-endpoint-s3) in the _AWS PrivateLink Guide_. @@ -96,0 +99,62 @@ Endpoint-specific S3 DNS names can be resolved from the S3 public DNS domain. +VPC endpoints for Amazon S3 support different types of IP addressing, including: IPv4, IPv6, and Dualstack. See IP Address types for VPC endpoints and DNS record IP types for VPC endpoints. + +## IP Address types for VPC endpoints + +VPC endpoints for Amazon S3 support different types of IP addressing, including: + + * **IPv4** + +VPC endpoints can be configured to use only IPv4 addresses for connectivity. + + * **IPv6** + +VPC endpoints can be configured to use only IPv6 addresses for connectivity. + + * **Dual-stack** + +VPC endpoints can be configured in dual-stack mode, supporting both IPv4 and IPv6 addresses simultaneously. This provides flexibility to access Amazon S3 over either IPv4 or IPv6 networks. + + + + +The IP address type you choose for your VPC endpoint will depend on the networking requirements of your applications and infrastructure. Considerations may include the IP addressing schemes used in your VPC, on-premises networks, and across the internet connectivity to Amazon S3. For more information, see IP address types for [interface endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html#aws-service-ip-address-type) and [gateway endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html#gateway-endpoint-ip-address-type) in the _Amazon Virtual Private Cloud_ guide. + +## DNS record IP types for VPC endpoints + +Depending on your IP address type, when you call a VPC endpoint, the AWS service can return `A` records, `AAAA` records, or both `A` and `AAAA` records. You can customize which record types your AWS service returns by modifying the DNS record IP type. The following table shows the supported DNS record IP types and the IP address types: + +Supported IP address types | DNS record IP types +---|--- +IPv4 | IPv4 +IPv6 | IPv6 +Dualstack | Dualstack, IPv4, IPv6, Service-defined + +### Configuring the service-defined DNS record IP type for Amazon S3 + +If you create a gateway endpoint for Amazon S3 and configure the DNS record IP type as service-defined and use the regional service endpoint,(such as `s3.us-east-2.amazonaws.com`), Amazon S3 returns `A` records to your clients. In contrast, if you create a gateway endpoint and are using a dual-stack service endpoint, (such as `s3.dualstack.us-east-2.amazonaws.com`) and select the DNS record IP type as `service-defined`, Amazon S3 returns both `A` and `AAAA` records to your clients. + +Similarly, if you create an interface endpoint with Private DNS enabled and choose service-defined as the DNS record type, for the regional service endpoint, (such as, `s3.us-east-2.amazonaws.com`), Amazon S3 returns `A` records to your client. Whereas, for a dualstack service endpoint, (such as, `s3.dualstack.us-east-2.amazonaws.com`), Amazon S3 returns both `A` and `AAAA` records. For more information, see DNS record IP type for [interface endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html#aws-services-dns-record-ip-type) and [gateway endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html#gateway-endpoint-dns-record-ip-type) in the _VPC User Guide_. + +The following table shows the supported DNS record IP types for gateway and interface endpoints: + +IP address type | Supported DNS record IP types for S3 Gateway endpoints | Supported DNS record IP types for S3 Interface endpoints +---|---|--- +IPv4 | IPv4, service-defined* | IPv4 +IPv6 | IPv6, service-defined* | IPv6 +Dualstack | IPv4, IPv6, Dualstack, service-defined* | Dualstack*, IPv4, IPv6, service-defined + +* Represents the default DNS record IP type. + +To enable IPv6 connectivity on an existing S3 gateway or interface endpoint, update the IP address type for the endpoint to `Dualstack`. When updated, Amazon S3 automatically updates the routing tables with IPv6 addresses for gateway endpoints. Then you can use the dualstack service endpoint, such as `s3.dualstack.us-east-2.amazonaws.com`, and Amazon S3 will return both `A` and `AAAA` records for dualstack S3 DNS queries. If you want to use IPV6 with the regional service endpoint, such as `s3.us-east-2.amazonaws.com`, modify the IP address type for the endpoint to `Dualstack`; and the DNS record IP type to `Dualstack`. Then Amazon S3 will return both `A` and `AAAA` records for the regional S3 DNS queries. + +###### Considerations + + * If your gateway endpoint has the default configuration of IP address type as `IPv4` and DNS record IP type as `service-defined`, then the dualstack service endpoint (such as `s3.dualstack.us-east-2.amazonaws.com`), traffic that uses `AAAA` records won't be routed through the gateway endpoint. Instead, this traffic will be dropped or routed over an IPv6-compatible path if one is present. For example, if your virtual private cloud (VPC) has an internet gateway, your IPv6 traffic will be routed over the internet gateway in your VPC in this scenario. If you want to ensure your traffic is always routed over a VPC endpoint, you can use an Amazon S3 bucket policy that restricts access to a specific bucket if a specified VPC endpoint is not used. For more information, see [Restricting access to a specific VPC endpoint](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html#example-bucket-policies-restrict-accesss-vpc-endpoint). + + * If your interface endpoint has the default configuration of IP address type, which is IPv4, and DNS record IP type as IPv4, dualstack service endpoints, such as `ass3.dualstack.us-east-2.amazonaws.com`, are not supported. Traffic that uses the `A` or `AAAA` records of the dualstack service endpoints won't be routed through the interface endpoint. Instead, this traffic will be dropped or routed over another compatible path if one is present. + + * Creating or modifying a gateway endpoint with a DNS record IP type other than service-defined requires both the `enableDnsSupport` and `enableDnsHostnames` VPC attributes to be set to true. + + + + @@ -110,2 +173,0 @@ Private DNS options for VPC interface endpoints simplify routing S3 traffic over -AWS PrivateLink for Amazon S3 does not support [Using Amazon S3 dual-stack endpoints](https://docs.aws.amazon.com/AmazonS3/latest/API/dual-stack-endpoints.html). If you use an S3 dual-stack DNS name as a private DNS name, your IPv6 traffic will either be dropped or, if your virtual private cloud (VPC) has an internet gateway, your IPv6 traffic will be routed over the internet gateway in your VPC. - @@ -119,0 +182,2 @@ If you want to update an existing interface endpoint to **Enable private DNS onl +When enabling **Private DNS for inbound resolver only** , the `dnsRecordIpType` of the gateway endpoint must either match that of interface endpoint or be **service defined**. + @@ -496,2 +559,0 @@ To specify the AWS account ID of the resource being accessed, you can use either -**Example: Restricting access to a specific VPC endpoint in the S3 bucket policy** -