AWS directconnect documentation change
Summary
Updated documentation to consistently use 'Direct Connect' instead of 'AWS Direct Connect' throughout the text
Security assessment
The changes are branding/terminology updates (removing 'AWS' from product name) without altering security-related content. Existing security controls like inbound packet filtering, NO_EXPORT BGP community usage, and route advertisement restrictions are maintained but not modified. No new vulnerabilities or security features are introduced.
Diff
diff --git a/directconnect/latest/UserGuide/routing-and-bgp.md b/directconnect/latest/UserGuide/routing-and-bgp.md index 7639589da..3acc00556 100644 --- a//directconnect/latest/UserGuide/routing-and-bgp.md +++ b//directconnect/latest/UserGuide/routing-and-bgp.md @@ -7 +7 @@ Public virtual interface routing policiesPublic virtual interface BGP communitie -# AWS Direct Connect routing policies and BGP communities +# Direct Connect routing policies and BGP communities @@ -9 +9 @@ Public virtual interface routing policiesPublic virtual interface BGP communitie -AWS Direct Connect applies inbound (from your on-premises data center) and outbound (from your AWS Region) routing policies for a public AWS Direct Connect connection. You can also use Border Gateway Protocol (BGP) community tags on routes advertised by Amazon and apply BGP community tags on the routes you advertise to Amazon. +Direct Connect applies inbound (from your on-premises data center) and outbound (from your AWS Region) routing policies for a public Direct Connect connection. You can also use Border Gateway Protocol (BGP) community tags on routes advertised by Amazon and apply BGP community tags on the routes you advertise to Amazon. @@ -13 +13 @@ AWS Direct Connect applies inbound (from your on-premises data center) and outbo -If you're using AWS Direct Connect to access public AWS services, you must specify the public IPv4 prefixes or IPv6 prefixes to advertise over BGP. +If you're using Direct Connect to access public AWS services, you must specify the public IPv4 prefixes or IPv6 prefixes to advertise over BGP. @@ -21 +21 @@ The following inbound routing policies apply: - * AWS Direct Connect performs inbound packet filtering to validate that the source of the traffic originated from your advertised prefix. + * Direct Connect performs inbound packet filtering to validate that the source of the traffic originated from your advertised prefix. @@ -28 +28 @@ The following outbound routing policies apply: - * AS_PATH and Longest Prefix Match are used to determine the routing path. AWS recommends advertising more specific routes using AWS Direct Connect if the same prefix is being advertised to both the Internet and to a public virtual interface. + * AS_PATH and Longest Prefix Match are used to determine the routing path. AWS recommends advertising more specific routes using Direct Connect if the same prefix is being advertised to both the Internet and to a public virtual interface. @@ -30 +30 @@ The following outbound routing policies apply: - * AWS Direct Connect advertises all local and remote AWS Region prefixes where available and includes on-net prefixes from other AWS non-Region points of presence (PoP) where available; for example, CloudFront and Route 53. + * Direct Connect advertises all local and remote AWS Region prefixes where available and includes on-net prefixes from other AWS non-Region points of presence (PoP) where available; for example, CloudFront and Route 53. @@ -40 +40 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * AWS Direct Connect advertises prefixes with a minimum path length of 3. + * Direct Connect advertises prefixes with a minimum path length of 3. @@ -42 +42 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * AWS Direct Connect advertises all public prefixes with the well-known `NO_EXPORT` BGP community. + * Direct Connect advertises all public prefixes with the well-known `NO_EXPORT` BGP community. @@ -46 +46 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * If you have multiple AWS Direct Connect connections, you can adjust the load-sharing of inbound traffic by advertising prefixes with the same path attributes. + * If you have multiple Direct Connect connections, you can adjust the load-sharing of inbound traffic by advertising prefixes with the same path attributes. @@ -48 +48 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * The prefixes advertised by AWS Direct Connect must not be advertised beyond the network boundaries of your connection. For example, these prefixes must not be included in any public internet routing table. + * The prefixes advertised by Direct Connect must not be advertised beyond the network boundaries of your connection. For example, these prefixes must not be included in any public internet routing table. @@ -50 +50 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * AWS Direct Connect keeps prefixes advertised by customers within the Amazon network. We do not re-advertise customer prefixes learned from a public VIF to any of the following: + * Direct Connect keeps prefixes advertised by customers within the Amazon network. We do not re-advertise customer prefixes learned from a public VIF to any of the following: @@ -52 +52 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] - * Other AWS Direct Connect customers + * Other Direct Connect customers @@ -68 +68 @@ For more information about the ip-ranges.json file, see [AWS IP address ranges ] -However, AWS Direct Connect will replace the private ASN with the AWS ASN (7224) when advertising your prefixes to other AWS customers or the internet. +However, Direct Connect will replace the private ASN with the AWS ASN (7224) when advertising your prefixes to other AWS customers or the internet. @@ -83 +83 @@ However, AWS Direct Connect will replace the private ASN with the AWS ASN (7224) -AWS Direct Connect supports scope BGP community tags to help control the scope (Regional or global) and route preference of traffic on public virtual interfaces. AWS treats all routes received from a public VIF as if they were tagged with the NO_EXPORT BGP community tag, meaning only the AWS network will use that routing information. +Direct Connect supports scope BGP community tags to help control the scope (Regional or global) and route preference of traffic on public virtual interfaces. AWS treats all routes received from a public VIF as if they were tagged with the NO_EXPORT BGP community tag, meaning only the AWS network will use that routing information. @@ -114 +114 @@ Prefixes that are marked with the same communities, and have identical AS_PATH a -The communities `7224:1` – `7224:65535` are reserved by AWS Direct Connect. +The communities `7224:1` – `7224:65535` are reserved by Direct Connect. @@ -116 +116 @@ The communities `7224:1` – `7224:65535` are reserved by AWS Direct Connect. -For outbound routing policies, AWS Direct Connect applies the following BGP communities to its advertised routes: +For outbound routing policies, Direct Connect applies the following BGP communities to its advertised routes: @@ -118 +118 @@ For outbound routing policies, AWS Direct Connect applies the following BGP comm - * `7224:8100`—Routes that originate from the same AWS Region in which the AWS Direct Connect point of presence is associated. + * `7224:8100`—Routes that originate from the same AWS Region in which the Direct Connect point of presence is associated. @@ -120 +120 @@ For outbound routing policies, AWS Direct Connect applies the following BGP comm - * `7224:8200`—Routes that originate from the same continent with which the AWS Direct Connect point of presence is associated. + * `7224:8200`—Routes that originate from the same continent with which the Direct Connect point of presence is associated. @@ -131 +131 @@ To receive all AWS public prefixes do not apply any filter. -Communities that are not supported for an AWS Direct Connect public connection are removed. +Communities that are not supported for an Direct Connect public connection are removed. @@ -137 +137 @@ For outbound routing policies, the `NO_EXPORT` BGP community tag is supported fo -AWS Direct Connect also provides BGP community tags on advertised Amazon routes. If you use AWS Direct Connect to access public AWS services, you can create filters based on these community tags. +Direct Connect also provides BGP community tags on advertised Amazon routes. If you use Direct Connect to access public AWS services, you can create filters based on these community tags. @@ -139 +139 @@ AWS Direct Connect also provides BGP community tags on advertised Amazon routes. -For public virtual interfaces, all routes that AWS Direct Connect advertises to customers are tagged with the NO_EXPORT community tag. +For public virtual interfaces, all routes that Direct Connect advertises to customers are tagged with the NO_EXPORT community tag. @@ -196 +196 @@ The following local preference BGP community tags are supported: -Local preference BGP community tags are mutually exclusive. To load balance traffic across multiple AWS Direct Connect connections (active/active) homed to the same or different AWS Regions, apply the same community tag; for example, `7224:7200` (medium preference) across the prefixes for the connections. If one of the connections fails, traffic will be then load balance using ECMP across the remaining active connections regardless of their home Region associations . To support failover across multiple AWS Direct Connect connections (active/passive), apply a community tag with a higher preference to the prefixes for the primary or active virtual interface and a lower preference to the prefixes for the backup or passive virtual interface. For example, set the BGP community tags for your primary or active virtual interfaces to `7224:7300` (high preference) and `7224:7100` (low preference) for your passive virtual interfaces. +Local preference BGP community tags are mutually exclusive. To load balance traffic across multiple Direct Connect connections (active/active) homed to the same or different AWS Regions, apply the same community tag; for example, `7224:7200` (medium preference) across the prefixes for the connections. If one of the connections fails, traffic will be then load balance using ECMP across the remaining active connections regardless of their home Region associations . To support failover across multiple Direct Connect connections (active/passive), apply a community tag with a higher preference to the prefixes for the primary or active virtual interface and a lower preference to the prefixes for the backup or passive virtual interface. For example, set the BGP community tags for your primary or active virtual interfaces to `7224:7300` (high preference) and `7224:7100` (low preference) for your passive virtual interfaces.