AWS elasticloadbalancing documentation change
Summary
Updated client IP preservation rules for QUIC/TCP_QUIC, added QUIC-specific constraints (fixed 300s deregistration delay, no proxy protocol v2 support, no sticky sessions)
Security assessment
Documents security-adjacent operational constraints (fixed connection draining time, proxy protocol limitations) that affect security monitoring and session management capabilities for QUIC traffic
Diff
diff --git a/elasticloadbalancing/latest/network/edit-target-group-attributes.md b/elasticloadbalancing/latest/network/edit-target-group-attributes.md index 9638d5594..ba0d560ff 100644 --- a//elasticloadbalancing/latest/network/edit-target-group-attributes.md +++ b//elasticloadbalancing/latest/network/edit-target-group-attributes.md @@ -34 +34 @@ Network Load Balancers can preserve the source IP addresses of clients when rout -By default, client IP preservation is enabled (and can't be disabled) for instance and IP type target groups with UDP and TCP_UDP protocols. However, you can enable or disable client IP preservation for TCP and TLS target groups using the `preserve_client_ip.enabled` target group attribute. +By default, client IP preservation is enabled (and can't be disabled) for instance and IP type target groups with UDP, TCP_UDP, QUIC, and TCP_QUIC protocols. However, you can enable or disable client IP preservation for TCP and TLS target groups using the `preserve_client_ip.enabled` target group attribute. @@ -40 +40 @@ By default, client IP preservation is enabled (and can't be disabled) for instan - * IP type target groups (UDP, TCP_UDP): Enabled + * IP type target groups (UDP, TCP_UDP, QUIC, TCP_QUIC): Enabled @@ -151 +151 @@ When a target is deregistered, the load balancer stops creating new connections -The initial state of a deregistering target is `draining`, during which the target will stop receiving new connections. However, the target may still receive connections due to configuration propagation delay. By default, the load balancer changes the state of a deregistering target to `unused` after 300 seconds. To change the amount of time that the load balancer waits before changing the state of a deregistering target to `unused`, update the deregistration delay value. We recommend that you specify a value of at least 120 seconds to ensure that requests are completed. +The initial state of a deregistering target is `draining`, during which the target will stop receiving new connections. However, the target may still receive connections due to configuration propagation delay. By default, the load balancer changes the state of a deregistering target to `unused` after 300 seconds. To change the amount of time that the load balancer waits before changing the state of a deregistering target to `unused`, update the deregistration delay value. We recommend that you specify a value of at least 120 seconds to ensure that requests are completed. For QUIC traffic the value is always 300 seconds, and can't be adjusted. @@ -219,0 +220,2 @@ TLS listeners do not support incoming connections with proxy protocol headers se +QUIC traffic does not support proxy protocol version 2. + @@ -319 +321 @@ Sticky sessions are a mechanism to route client traffic to the same target in a - * Sticky sessions are not supported for TLS listeners. + * Sticky sessions are not supported for TLS or QUIC listeners.