AWS AmazonECR documentation change
Summary
Added dual-stack (IPv4/IPv6) support documentation for VPC endpoints and related S3 endpoint requirements
Security assessment
Documents enhanced network security capabilities (dual-stack private connectivity) but doesn't fix vulnerabilities. Improves security posture documentation by detailing IPv6 support.
Diff
diff --git a/AmazonECR/latest/userguide/vpc-endpoints.md b/AmazonECR/latest/userguide/vpc-endpoints.md index 304d748e0..a67575625 100644 --- a//AmazonECR/latest/userguide/vpc-endpoints.md +++ b//AmazonECR/latest/userguide/vpc-endpoints.md @@ -9 +9 @@ Considerations for Amazon ECR VPC endpointsCreate the VPC endpoints for Amazon E -You can improve the security posture of your VPC by configuring Amazon ECR to use an interface VPC endpoint. VPC endpoints are powered by AWS PrivateLink, a technology that enables you to privately access Amazon ECR APIs through private IP addresses. AWS PrivateLink restricts all network traffic between your VPC and Amazon ECR to the Amazon network. You don't need an internet gateway, a NAT device, or a virtual private gateway. +You can improve the security posture of your VPC by configuring Amazon ECR to use an interface VPC endpoint. VPC endpoints are powered by AWS PrivateLink, a technology that enables you to privately access Amazon ECR APIs through private IP addresses (both IPv4 and IPv6). AWS PrivateLink restricts all network traffic between your VPC and Amazon ECR to the Amazon network. You don't need an internet gateway, a NAT device, or a virtual private gateway. @@ -22,0 +23,2 @@ Before you configure VPC endpoints for Amazon ECR, be aware of the following con + * Amazon ECR VPC endpoints support dual-stack (IPv4 and IPv6) connectivity. When you create a dual-stack VPC endpoint, it can handle traffic over both IPv4 and IPv6 private IP addresses. + @@ -66,0 +69,4 @@ To create the VPC endpoints for the Amazon ECR service, use the [Creating an Int +Amazon ECR VPC endpoints support dual-stack (IPv4 and IPv6) connectivity. When you create a dual-stack VPC endpoint, it automatically handles traffic over both IPv4 and IPv6 private IP addresses. The endpoint will route traffic using the appropriate IP version based on your client's network configuration and the endpoint's capabilities. + +If you have existing IPv4-only VPC endpoints and want to migrate to dual-stack endpoints, you can modify your existing endpoints to support dual-stack connectivity, or create new dual-stack endpoints. When creating or modifying endpoints, ensure that your VPC and subnets support the IP version you want to use. After creating dual-stack endpoints, the endpoints will support both IPv4 and IPv6. + @@ -122,0 +129,4 @@ For your Amazon ECS tasks to pull private images from Amazon ECR, you must creat +###### Note + +If creating a dual-stack VPC endpoint for Amazon ECR, then you also need to create a dual-stack Amazon S3 Gateway or Interface endpoint. Refer to [S3 documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#privatelink-ip-address-types) for details. +