AWS network-manager documentation change
Summary
Added documentation for routing policies and attachment routing policies, including new sections explaining fine-grained routing controls, route filtering, and path preferences. Updated references to service insertion and segment actions.
Security assessment
The changes introduce documentation for routing policy features that enable better traffic control and route filtering, which are security-adjacent capabilities. However, there is no explicit mention of addressing a specific security vulnerability or incident. The additions focus on explaining new security-enhancing features rather than patching a security issue.
Diff
diff --git a/network-manager/latest/cloudwan/cloudwan-create-policy-version.md b/network-manager/latest/cloudwan/cloudwan-create-policy-version.md index 85bf92e4f..5b53e5d02 100644 --- a//network-manager/latest/cloudwan/cloudwan-create-policy-version.md +++ b//network-manager/latest/cloudwan/cloudwan-create-policy-version.md @@ -36 +36,3 @@ You can create a core network policy version through either the AWS Cloud WAN co - * [Cloud WAN service insertion](./cloudwan-policy-service-insertion.html) + * [Service insertion](./cloudwan-policy-service-insertion.html) + + * [Routing policies](./cloudwan-routing-policies.html) @@ -72,0 +75,4 @@ The following are the parts of a core network policy and describe how each of th + * Routing policies + + * Attachment routing policies + @@ -119 +125,3 @@ Segment actions allow you to optionally share your segments, create routes, or c - * **Segment sharing** — Segment sharing is bidirectional by default. When you create a segment share between two segments, routes from both segments are automatically advertised to each other. For example, you might share a segment named `test` with another segment named `dev`. Routes from `test` are advertised to `dev`, and vice versa. To make routes in shared segments unidirectional, create a deny list filter to share routes from one segment to the other, but not vice versa. Using the previous example, you could make a deny list filter that prevents routes from `test` being advertised to `dev`. For more information on creating the deny list for a segment, see [Add a segment to an AWS Cloud WAN core network policy version](./cloudwan-policy-segments.html). + * **Segment sharing** — Segment sharing is bidirectional by default. When you create a segment share between two segments, routes from both segments are automatically advertised to each other. For example, you might share a segment named `test` with another segment named `dev`. Routes from `test` are advertised to `dev`, and vice versa. To make routes in shared segments unidirectional, create a deny list filter to share routes from one segment to the other, but not vice versa. Using the previous example, you could make a deny list filter that prevents routes from `test` being advertised to `dev`. For more information on creating the deny list for a segment, see [Add a segment to an AWS Cloud WAN core network policy version](./cloudwan-policy-segments.html). In addition, you can optionally associate routing policies that will apply to the segment share. + + * **Edge location routing policy association** — Associate routing policies to pair of edge locations for a particular segment. @@ -130 +138 @@ See the following for the steps to set segment actions: - * To add a segment using the console, see [Add a segment action in an AWS Cloud WAN core network policy version](./cloudwan-policy-network-actions-routes.html). + * To add a segment using the console, see [Add segment actions in an AWS Cloud WAN core network policy version](./cloudwan-policy-network-actions-routes.html). @@ -149,0 +158,31 @@ See the following for the steps to create a network functions group attachment p +### Routing policies + +Routing policies provide new routing capabilities that allow you to implement fine-grained routing controls, route filtering, summarization, and path preferences. You can create routing policy associations to apply policies to specific segment shares, edge location pairs, and attachments with rules that define how routes are processed. + +Routing policy associations can be broken down into two main components: + + * **Segment Share/Edge Location Pairs** — Associate routing policies with specific segment shares or edge location pairs to control traffic flow between different parts of your network. + + * **Attachment routing policies** — Create rules-based policies that determine which routing policies are associated with attachments. + + + + +See the following for the steps to configure routing policies: + + * To configure routing policies using the console, see [Create a routing policy and rule](./cloudwan-route-policy.html). + + + + +### Attachment routing policies + +Attachment routing policies control how your attachments map to your routing policies. Attachment routing policies are separate from the attachment policy section and only control associating attachments with routing policies via a label on the attachment. + +See the following for the steps to create an attachment routing policy: + + * To add an attachment routing policy using the console, see [Create an AWS Cloud WAN attachment routing policy](./cloudwan-policy-attachment-routing.html). + + + + @@ -158 +197 @@ Delete an attachment -Cloud WAN service insertion +Service insertion