AWS AWSCloudFormation documentation change
Summary
Added documentation for new NAT gateway properties: AvailabilityMode, AvailabilityZoneAddresses, AutoProvisionZones, AutoScalingIps, and RouteTableId. These properties relate to configuring regional (multi-AZ) NAT gateways with automatic/managed AZ expansion and EIP allocation.
Security assessment
The changes describe operational aspects of NAT gateway redundancy and scalability across AZs, but do not address vulnerabilities, security controls, or security incidents. The documentation focuses on availability and network architecture rather than security protections.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-natgateway.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-natgateway.md index 8174cbf88..f265f5ced 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-natgateway.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-natgateway.md @@ -29,0 +30,2 @@ To declare this entity in your CloudFormation template, use the following syntax + "AvailabilityMode" : String, + "AvailabilityZoneAddresses" : [ [AvailabilityZoneAddress](./aws-properties-ec2-natgateway-availabilityzoneaddress.html), ... ], @@ -48,0 +51,3 @@ To declare this entity in your CloudFormation template, use the following syntax + AvailabilityMode: String + AvailabilityZoneAddresses: + - [AvailabilityZoneAddress](./aws-properties-ec2-natgateway-availabilityzoneaddress.html) @@ -75,0 +81,32 @@ _Required_ : Conditional +`AvailabilityMode` + + +Indicates whether this is a zonal (single-AZ) or regional (multi-AZ) NAT gateway. + +A zonal NAT gateway is a NAT Gateway that provides redundancy and scalability within a single availability zone. A regional NAT gateway is a single NAT Gateway that works across multiple availability zones (AZs) in your VPC, providing redundancy, scalability and availability across all the AZs in a Region. + +For more information, see [Regional NAT gateways for automatic multi-AZ expansion](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateways-regional.html) in the _Amazon VPC User Guide_. + +_Required_ : No + + _Type_ : String + + _Allowed values_ : `zonal | regional` + + _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) + +`AvailabilityZoneAddresses` + + +For regional NAT gateways only: Specifies which Availability Zones you want the NAT gateway to support and the Elastic IP addresses (EIPs) to use in each AZ. The regional NAT gateway uses these EIPs to handle outbound NAT traffic from their respective AZs. If not specified, the NAT gateway will automatically expand to new AZs and associate EIPs upon detection of an elastic network interface. If you specify this parameter, auto-expansion is disabled and you must manually manage AZ coverage. + +A regional NAT gateway is a single NAT Gateway that works across multiple availability zones (AZs) in your VPC, providing redundancy, scalability and availability across all the AZs in a Region. + +For more information, see [Regional NAT gateways for automatic multi-AZ expansion](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateways-regional.html) in the _Amazon VPC User Guide_. + +_Required_ : No + + _Type_ : Array of [AvailabilityZoneAddress](./aws-properties-ec2-natgateway-availabilityzoneaddress.html) + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + @@ -202,0 +240,16 @@ For more information about using the `Fn::GetAtt` intrinsic function, see [`Fn:: +`AutoProvisionZones` + + +For regional NAT gateways only: Indicates whether AWS automatically manages AZ coverage. When enabled, the NAT gateway associates EIPs in all AZs where your VPC has subnets to handle outbound NAT traffic, expands to new AZs when you create subnets there, and retracts from AZs where you've removed all subnets. When disabled, you must manually manage which AZs the NAT gateway supports and their corresponding EIPs. + +A regional NAT gateway is a single NAT Gateway that works across multiple availability zones (AZs) in your VPC, providing redundancy, scalability and availability across all the AZs in a Region. + +For more information, see [Regional NAT gateways for automatic multi-AZ expansion](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateways-regional.html) in the _Amazon VPC User Guide_. + +`AutoScalingIps` + + +For regional NAT gateways only: Indicates whether AWS automatically allocates additional Elastic IP addresses (EIPs) in an AZ when the NAT gateway needs more ports due to increased concurrent connections to a single destination from that AZ. + +For more information, see [Regional NAT gateways for automatic multi-AZ expansion](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateways-regional.html) in the _Amazon VPC User Guide_. + @@ -212,0 +266,5 @@ The ID of the NAT gateway. +`RouteTableId` + + +For regional NAT gateways only, this is the ID of the NAT gateway. + @@ -281 +339 @@ Tag -Tag +AvailabilityZoneAddress