AWS network-firewall documentation change
Summary
Updated propagation time estimate for firewall changes from 'seconds' to 'minutes'
Security assessment
The change clarifies operational timing but does not address a security vulnerability or weakness. It improves accuracy of expected propagation delays, which could help users plan deployments but does not directly mitigate risks.
Diff
diff --git a/network-firewall/latest/developerguide/rule-group-stateful-deleting.md b/network-firewall/latest/developerguide/rule-group-stateful-deleting.md index bc7642385..71ca73bfc 100644 --- a//network-firewall/latest/developerguide/rule-group-stateful-deleting.md +++ b//network-firewall/latest/developerguide/rule-group-stateful-deleting.md @@ -26 +26 @@ When you delete a rule group, TLS inspection configuration, or a firewall policy -When you make any changes to a firewall, including changes to any of the firewall's components, like rule groups, TLS inspection configurations, and firewall policies, Network Firewall propagates the changes everywhere that the firewall is used. Your changes are normally applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. For example, if you modify a rule group so that it drops an additional type of packet, for a firewall that uses the rule group, the new packet type might briefly be dropped by one firewall endpoint while still being allowed by another. +When you make any changes to a firewall, including changes to any of the firewall's components, like rule groups, TLS inspection configurations, and firewall policies, Network Firewall propagates the changes everywhere that the firewall is used. Your changes are normally applied within minutes, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. For example, if you modify a rule group so that it drops an additional type of packet, for a firewall that uses the rule group, the new packet type might briefly be dropped by one firewall endpoint while still being allowed by another.