AWS vpn documentation change
Summary
Added 'Prerequisites' section with configuration requirements for private IP VPN over Direct Connect, including CIDR block overlap warnings
Security assessment
While the CIDR overlap warning helps prevent configuration issues, there is no explicit mention of security vulnerabilities or security controls. The changes focus on operational prerequisites rather than security features.
Diff
diff --git a/vpn/latest/s2svpn/private-ip-dx.md b/vpn/latest/s2svpn/private-ip-dx.md index 33735d376..bb7a9200a 100644 --- a//vpn/latest/s2svpn/private-ip-dx.md +++ b//vpn/latest/s2svpn/private-ip-dx.md @@ -5 +5 @@ -Benefits of private IP VPNHow private IP VPN works +Benefits of private IP VPNHow private IP VPN worksPrerequisites @@ -33,0 +34,14 @@ For more details on the traffic path leaving the VPN, see [Private virtual inter +## Prerequisites + +The following table describes the perquisites before creating a private IP VPN over Direct Connect. + +Item | Steps | Information +---|---|--- +Prepare the transit gateway for Site-to-Site VPN. | Create the transit gateway by using the Amazon Virtual Private Cloud (VPC) console or using the command-line or API. See [Transit gateways](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html) in the _Amazon VPC Transit Gateways Guide_. | A transit gateway is a network transit hub that you can use to interconnect your VPCs and on-premises networks. You can create a new transit gateway or use an existing one for the private IP VPN connection. When you create the transit gateway, or modify an existing transit gateway, you specify a private IP CIDR block for the connection. + +###### Note + +When specifying the transit gateway CIDR block to be associated with your Private IP VPN, ensure the CIDR block does not overlap with any IP addresses for any other network attachments on the transit gateway. If any IP CIDR blocks do overlap, it may cause configuration issues with your customer gateway device. +Create the AWS Direct Connect gateway for Site-to-Site VPN. | Create the Direct Connect gateway by using the Direct Connect console or by using the command-line or API. See [Create an AWS Direct Connect gateway](https://docs.aws.amazon.com/directconnect/latest/UserGuide/create-direct-connect-gateway.html) in the _AWS Direct Connect User Guide_. | A Direct Connect gateway allows you to connect virtual interfaces (VIFs) across multiple AWS Regions. This gateway is used to connect to your VIF. +Create the transit gateway association for Site-to-Site VPN. | Create the association between the Direct Connect gateway and the transit gateway by using the Direct Connect console or using the command-line or API. See [Associate or disassociate AWS Direct Connect with a transit gateway](https://docs.aws.amazon.com/directconnect/latest/UserGuide/associate-tgw-with-direct-connect-gateway.html) in the _AWS Direct Connect User Guide_. | After creating the AWS Direct Connect gateway, create a transit gateway association for the AWS Direct Connect gateway. Specify the private IP CIDR for the transit gateway that was identified earlier in the allowed prefixes list. +