AWS iot documentation change
Summary
Added documentation for AWS IoT Core control plane VPC endpoints, updated DNS configuration guidance, expanded regional/FIPS support details, and added limitations for control plane endpoints.
Security assessment
The changes introduce documentation for control plane VPC endpoints (a security feature using AWS PrivateLink to keep traffic private) and FIPS compliance guidance. While these are security-related features, there is no evidence of addressing a specific vulnerability or incident. The updates primarily expand security documentation rather than fix a security issue.
Diff
diff --git a/iot/latest/developerguide/IoTCore-VPC.md b/iot/latest/developerguide/IoTCore-VPC.md index 9d60346c3..32cd13df9 100644 --- a//iot/latest/developerguide/IoTCore-VPC.md +++ b//iot/latest/developerguide/IoTCore-VPC.md @@ -5 +5 @@ -Creating VPC endpoints for AWS IoT Core data planeCreating VPC endpoints for AWS IoT Core credential providerCreating an Amazon VPC interface endpointConfiguring private hosted zoneControlling Access to AWS IoT Core over VPC endpointsLimitationsScaling VPC endpoints with AWS IoT CoreUsing custom domains with VPC endpointsAvailability of VPC endpoints for AWS IoT Core +Creating VPC endpoints for AWS IoT Core control planeCreating VPC endpoints for AWS IoT Core data planeCreating VPC endpoints for AWS IoT Core credential providerCreating an Amazon VPC interface endpointConfigure a private hosted zoneControlling Access to AWS IoT Core over VPC endpointsLimitationsScaling VPC endpoints with AWS IoT CoreUsing custom domains with VPC endpointsAvailability of VPC endpoints for AWS IoT Core @@ -9 +9 @@ Creating VPC endpoints for AWS IoT Core data planeCreating VPC endpoints for AWS -With AWS IoT Core, you can create [IoT data endpoints](https://docs.aws.amazon.com/iot/latest/developerguide/iot-connect-devices.html) within your virtual private cloud (VPC) by using [interface VPC endpoints](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint). Interface VPC endpoints are powered by AWS PrivateLink, an AWS technology that you can use to access services running on AWS by using private IP addresses. For more information, see [Amazon Virtual Private Cloud](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html). +With AWS IoT Core, you can create [IoT control plane endpoints](https://docs.aws.amazon.com/iot/latest/developerguide/connect-to-iot.html#iot-service-endpoint-intro) and [IoT data endpoints](https://docs.aws.amazon.com/iot/latest/developerguide/iot-connect-devices.html) within your virtual private cloud (VPC) by using [interface VPC endpoints](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint). Interface VPC endpoints are powered by AWS PrivateLink, an AWS technology that you can use to access services running on AWS by using private IP addresses. For more information, see [Amazon Virtual Private Cloud](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html). @@ -14,0 +15,2 @@ To connect devices in the field on remote networks, such as a corporate network + * Creating VPC endpoints for AWS IoT Core control plane + @@ -21 +23 @@ To connect devices in the field on remote networks, such as a corporate network - * Configuring private hosted zone + * Configure a private hosted zone @@ -32,0 +35,8 @@ To connect devices in the field on remote networks, such as a corporate network + * [Using AWS IoT Device Management secure tunneling with interface VPC endpoints](./IoTCore-ST-VPC.html) + + + + +## Creating VPC endpoints for AWS IoT Core control plane + +You can create a VPC endpoint for AWS IoT Core control plane API to connect your devices to AWS IoT services and other AWS services. To get started with VPC endpoints, [create an interface VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html#create-interface-endpoint) and select AWS IoT Core as the AWS service. If you are using the CLI, first call [describe-vpc-endpoint-services](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoint-services.html) to ensure that you are choosing an Availability Zone where AWS IoT Core is present in your particular AWS Region. For example, in us-east-1, this command would look like: @@ -34,0 +45,3 @@ To connect devices in the field on remote networks, such as a corporate network + aws ec2 describe-vpc-endpoint-services --service-name com.amazonaws.us-east-1.iot.api + +See the detailed instructions below to Create an Amazon VPC interface endpoint for AWS IoT Core control plane. @@ -103,0 +117,2 @@ The processes to create an Amazon VPC interface endpoint for AWS IoT Core data p +If you create a VPC endpoint for AWS IoT Core control plane, choose the AWS IoT Core control plane API endpoint for your AWS Region. The endpoint will be of the format `com.amazonaws.`region`.iot.api`. + @@ -107,0 +123,2 @@ If you create a VPC endpoint for AWS IoT Core credential provider, choose the AW +If you create a VPC endpoint for Federal Information Processing Standard (FIPS) regions, choose the FIPS API endpoint for your AWS Region. The endpoint will be of the format `com.amazonaws.`region`.iot-fips.api`. This is only for control plane. + @@ -110 +127 @@ If you create a VPC endpoint for AWS IoT Core credential provider, choose the AW -The service name for AWS IoT Core data plane in China Region will be of the format `cn.com.amazonaws.`region`.iot.data`. Creating VPC endpoints for AWS IoT Core credential provider is not supported in China Region. +The service name for AWS IoT Core data plane in China Region will be of the format `cn.com.amazonaws.`region`.iot.data`. The service name for AWS IoT Core control plane in China Region will be of the format `com.amazonaws.`region`.iot.api`. @@ -114 +131,3 @@ The service name for AWS IoT Core data plane in China Region will be of the form - * For **Enable DNS name** , make sure that **Enable for this endpoint** is not selected. Neither AWS IoT Core data plane nor AWS IoT Core credential provider supports private DNS names yet. + * For **Enable DNS name** , make sure that **Enable for this endpoint** is not selected for AWS IoT Core data plane and AWS IoT Core credential provider. Neither AWS IoT Core data plane nor AWS IoT Core credential provider supports private DNS names yet. + +For AWS IoT Core control plane, **Enable DNS name** is selected by default. This ensures that any requests to the AWS IoT Core control plane public endpoints will route through the VPC endpoints instead. When this is enabled, you do not need to configure a privated hosted zone. @@ -125 +144,3 @@ The service name for AWS IoT Core data plane in China Region will be of the form -After you create the AWS PrivateLink endpoint, in the **Details** tab of your endpoint, you'll see a list of DNS names. You can use one of these DNS names you created in this section to configure your private hosted zone. +After you create the AWS PrivateLink endpoint, in the **Details** tab of your endpoint, you'll see a list of DNS names. You can use one of these DNS names you created in this section to configure your private hosted zone. If you are using AWS IoT Core control plane, you do not need to configure a private hosted zone. + +## Configure a private hosted zone @@ -127 +148,3 @@ After you create the AWS PrivateLink endpoint, in the **Details** tab of your en -## Configuring private hosted zone +###### Note + +If you are using AWS IoT Core control plane and have **Enable DNS name** selected, you do not need to configure a private hosted zone. If you disable it, you must follow this procedure to configure a private hosted zone. @@ -138,0 +162,4 @@ The DNS name must be your `iot:CredentialProvider` endpoint. An example DNS name +**For AWS IoT Core control plane** + +The DNS name must be your AWS IoT Core control plane endpoint. An example DNS name for AWS IoT Core control plane is ` `xxxx`.api.iot.`region`.amazonaws.com`. + @@ -251 +278,14 @@ For example, the following policy grants permission to connect to AWS IoT Core u -VPC endpoints are currently supported only for [AWS IoT Core data endpoints](https://docs.aws.amazon.com/iot/latest/developerguide/iot-connect-devices.html#iot-connect-device-endpoints) and [AWS IoT Core credential provider](https://docs.aws.amazon.com/iot/latest/developerguide/authorizing-direct-aws.htm) endpoints. VPC endpoints are not supported for [Federal Information Processing Standard (FIPS) endpoints](https://docs.aws.amazon.com/iot/latest/developerguide/iot-connect-fips.html). +VPC endpoints are currently supported for [AWS IoT Core control plane endpoints](https://docs.aws.amazon.com/iot/latest/developerguide/connect-to-iot.html#iot-service-endpoint-intro), [AWS IoT Core data endpoints](https://docs.aws.amazon.com/iot/latest/developerguide/iot-connect-devices.html#iot-connect-device-endpoints), and [AWS IoT Core credential provider](https://docs.aws.amazon.com/iot/latest/developerguide/authorizing-direct-aws.htm) endpoints. VPC endpoints are only supported for [Federal Information Processing Standard (FIPS) endpoints](https://docs.aws.amazon.com/iot/latest/developerguide/iot-connect-fips.html) when using the AWS IoT Core control plane. + +### Limitations of IoT control plane VPC endpoints + +This section covers the limitations of IoT control plane VPC endpoints. + + * VPC endpoints will serve ATS certificates only. + + * Custom domains are not supported for control plane endpoints. + + * For information regarding FIPS security policies, see [FIPS security policies](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#fips-security-policies). + + + @@ -309 +349 @@ Resilience -Infrastructure security +Using AWS IoT Device Management with VPC endpoints