AWS vpc documentation change
Summary
Updated documentation for S3 gateway endpoints to include IPv6 support, clarify DNS record IP type requirements, differentiate between general purpose and directory buckets, and add IP address type configuration steps.
Security assessment
The changes emphasize using private IPv4/IPv6 addresses instead of public ones, which improves security by keeping traffic within the VPC. However, there is no explicit mention of addressing a specific vulnerability. The DNS record IP type clarification helps prevent misconfigurations but does not directly resolve a security flaw.
Diff
diff --git a/vpc/latest/privatelink/vpc-endpoints-s3.md b/vpc/latest/privatelink/vpc-endpoints-s3.md index 098ce5587..db914e4d0 100644 --- a//vpc/latest/privatelink/vpc-endpoints-s3.md +++ b//vpc/latest/privatelink/vpc-endpoints-s3.md @@ -48,3 +48 @@ Amazon S3 supports both gateway endpoints and interface endpoints. With a gatewa - * Gateway endpoints support only IPv4 traffic. - - * The source IPv4 addresses from instances in your affected subnets as received by Amazon S3 change from public IPv4 addresses to the private IPv4 addresses in your VPC. An endpoint switches network routes, and disconnects open TCP connections. The previous connections that used public IPv4 addresses are not resumed. We recommend that you do not have any critical tasks running when you create or modify an endpoint; or that you test to ensure that your software can automatically reconnect to Amazon S3 after the connection break. + * The source IPv4 or IPv6 addresses from instances in your affected subnets as received by Amazon S3 change from public addresses to the private addresses in your VPC. An endpoint switches network routes, and disconnects open TCP connections. The previous connections that used public addresses are not resumed. We recommend that you do not have any critical tasks running when you create or modify an endpoint; or that you test to ensure that your software can automatically reconnect to Amazon S3 after the connection break. @@ -78,0 +77,2 @@ If you configure private DNS only for the inbound Resolver endpoint, requests fr +In order to configure this, the DNS record IP type of the gateway endpoint must match the interface endpoint or be `service-defined`. AWS PrivateLink doesn't support any other combination. For more information, see [DNS record IP type](./gateway-endpoints.html#gateway-endpoint-dns-record-ip-type). + @@ -99 +99,5 @@ Use the following procedure to create a gateway endpoint that connects to Amazon - 5. For **Services** , add the filter **Type = Gateway** and select **com.amazonaws.**`region`**.s3**. + 5. For **Services** , add the filter **Type = Gateway**. + +If your Amazon S3 data is stored in general purpose buckets, select **com.amazonaws.**`region`**.s3**. + +If your Amazon S3 data is stored in directory buckets, select **com.amazonaws.**`region`**.s3express**. @@ -103 +107,9 @@ Use the following procedure to create a gateway endpoint that connects to Amazon - 7. For **Route tables** , select the route tables to be used by the endpoint. We automatically add a route that points traffic destined for the service to the endpoint network interface. + 7. For **IP address type** , choose from the following options: + + * **IPv4** – Assign IPv4 addresses to the endpoint network interfaces. This option is supported only if all selected subnets have IPv4 address ranges and the service accepts IPv4 requests. + + * **IPv6** – Assign IPv6 addresses to the endpoint network interfaces. This option is supported only if all selected subnets are IPv6 only subnets and the service accepts IPv6 requests. + + * **Dualstack** – Assign both IPv4 and IPv6 addresses to the endpoint network interfaces. This option is supported only if all selected subnets have both IPv4 and IPv6 address ranges and the service accepts both IPv4 and IPv6 requests. + + 8. For **Route tables** , select the route tables to be used by the endpoint. We automatically add a route that points traffic destined for the service to the endpoint network interface. @@ -105 +117 @@ Use the following procedure to create a gateway endpoint that connects to Amazon - 8. For **Policy** , select **Full access** to allow all operations by all principals on all resources over the VPC endpoint. Otherwise, select **Custom** to attach a VPC endpoint policy that controls the permissions that principals have to perform actions on resources over the VPC endpoint. + 9. For **Policy** , select **Full access** to allow all operations by all principals on all resources over the VPC endpoint. Otherwise, select **Custom** to attach a VPC endpoint policy that controls the permissions that principals have to perform actions on resources over the VPC endpoint. @@ -107 +119 @@ Use the following procedure to create a gateway endpoint that connects to Amazon - 9. (Optional) To add a tag, choose **Add new tag** and enter the tag key and the tag value. + 10. (Optional) To add a tag, choose **Add new tag** and enter the tag key and the tag value. @@ -109 +121 @@ Use the following procedure to create a gateway endpoint that connects to Amazon - 10. Choose **Create endpoint**. + 11. Choose **Create endpoint**.