AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2025-11-22 · Documentation low

File: AWSCloudFormation/latest/TemplateReference/aws-properties-ec2-vpcendpoint-dnsoptionsspecification.md

Summary

Added PrivateDnsPreference and PrivateDnsSpecifiedDomains properties to configure private DNS behavior for VPC endpoints

Security assessment

The changes add documentation for DNS configuration options that control private hosted zone associations. While this improves security posture by allowing granular DNS control, there's no evidence of addressing a specific security vulnerability.

Diff

diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-ec2-vpcendpoint-dnsoptionsspecification.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-ec2-vpcendpoint-dnsoptionsspecification.md
index 2f61b9d5d..e245d9b51 100644
--- a//AWSCloudFormation/latest/TemplateReference/aws-properties-ec2-vpcendpoint-dnsoptionsspecification.md
+++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-ec2-vpcendpoint-dnsoptionsspecification.md
@@ -20 +20,3 @@ To declare this entity in your CloudFormation template, use the following syntax
-      "PrivateDnsOnlyForInboundResolverEndpoint" : String
+      "PrivateDnsOnlyForInboundResolverEndpoint" : String,
+      "PrivateDnsPreference" : String,
+      "PrivateDnsSpecifiedDomains" : [ String, ... ]
@@ -28,0 +31,3 @@ To declare this entity in your CloudFormation template, use the following syntax
+      PrivateDnsPreference: String
+      PrivateDnsSpecifiedDomains: 
+        - String
@@ -58,0 +64,28 @@ _Required_ : No
+`PrivateDnsPreference`
+    
+
+The preference for which private domains have a private hosted zone created for and associated with the specified VPC. Only supported when private DNS is enabled and when the VPC endpoint type is ServiceNetwork or Resource.
+
+_Required_ : No
+
+ _Type_ : String
+
+ _Allowed values_ : `VERIFIED_DOMAINS_ONLY | ALL_DOMAINS | VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS | SPECIFIED_DOMAINS_ONLY`
+
+ _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)
+
+`PrivateDnsSpecifiedDomains`
+    
+
+Indicates which of the private domains to create private hosted zones for and associate with the specified VPC. Only supported when private DNS is enabled and the private DNS preference is `VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS` or `SPECIFIED_DOMAINS_ONLY`.
+
+_Required_ : No
+
+ _Type_ : Array of String
+
+ _Minimum_ : `1 | 1`
+
+ _Maximum_ : `255 | 10`
+
+ _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)
+