AWS vpc documentation change
Summary
Added cross-region endpoint configuration steps and reordered service selection/VPC selection steps. Updated section title for cross-region services.
Security assessment
The changes primarily add documentation for cross-region endpoint functionality and reorganize existing steps. No specific security vulnerabilities or security feature enhancements are mentioned. While VPC endpoint configuration relates to network security, these changes appear to be feature documentation updates rather than addressing specific security issues.
Diff
diff --git a/vpc/latest/privatelink/create-interface-endpoint.md b/vpc/latest/privatelink/create-interface-endpoint.md index a1d40a8fa..3922b9a22 100644 --- a//vpc/latest/privatelink/create-interface-endpoint.md +++ b//vpc/latest/privatelink/create-interface-endpoint.md @@ -59 +59 @@ Use the following procedure to create an interface VPC endpoint that connects to - 5. For **Service name** , select the service. For more information, see [AWS services that integrate with AWS PrivateLink](./aws-services-privatelink-support.html). + 5. (Optional) If creating an endpoint to an AWS service in another Region, select the **Enable cross Region endpoint** checkbox and then select the **service region** from the drop down. @@ -61 +61 @@ Use the following procedure to create an interface VPC endpoint that connects to - 6. For **VPC** , select the VPC from which you'll access the AWS service. + 6. For **Service name** , select the service. For more information, see [AWS services that integrate with AWS PrivateLink](./aws-services-privatelink-support.html). @@ -63 +63,3 @@ Use the following procedure to create an interface VPC endpoint that connects to - 7. If, in Step 5, you selected the service name for Amazon S3, and if you want to configure [private DNS support](./vpc-endpoints-s3.html#private-dns-s3), select **Additional settings** , **Enable DNS name**. When you make this selection, it also automatically selects **Enable private DNS only for inbound endpoint**. You can configure private DNS with an inbound Resolver endpoint only for interface endpoints for Amazon S3. If you do not have a gateway endpoint for Amazon S3 and you select **Enable private DNS only for inbound endpoint** , you'll receive an error when you attempt the final step in this procedure. + 7. For **VPC** , select the VPC from which you'll access the AWS service. + + 8. If, in Step 5, you selected the service name for Amazon S3, and if you want to configure [private DNS support](./vpc-endpoints-s3.html#private-dns-s3), select **Additional settings** , **Enable DNS name**. When you make this selection, it also automatically selects **Enable private DNS only for inbound endpoint**. You can configure private DNS with an inbound Resolver endpoint only for interface endpoints for Amazon S3. If you do not have a gateway endpoint for Amazon S3 and you select **Enable private DNS only for inbound endpoint** , you'll receive an error when you attempt the final step in this procedure. @@ -67 +69 @@ If, in Step 5, you selected the service name for any service other than Amazon S - 8. For **Subnets** , select the subnets in which to create endpoint network interfaces. You can select one subnet per Availability Zone. You can't select multiple subnets from the same Availability Zone. For more information, see [Subnets and Availability Zones](./privatelink-access-aws-services.html#aws-service-subnets-zones). + 9. For **Subnets** , select the subnets in which to create endpoint network interfaces. You can select one subnet per Availability Zone. You can't select multiple subnets from the same Availability Zone. For more information, see [Subnets and Availability Zones](./privatelink-access-aws-services.html#aws-service-subnets-zones). @@ -71 +73 @@ By default, we select IP addresses from the subnet IP address ranges and assign - 9. For **IP address type** , choose from the following options: + 10. For **IP address type** , choose from the following options: @@ -79 +81 @@ By default, we select IP addresses from the subnet IP address ranges and assign - 10. For **Security groups** , select the security groups to associate with the endpoint network interfaces. By default, we associate the default security group for the VPC. + 11. For **Security groups** , select the security groups to associate with the endpoint network interfaces. By default, we associate the default security group for the VPC. @@ -81 +83 @@ By default, we select IP addresses from the subnet IP address ranges and assign - 11. For **Policy** , to allow all operations by all principals on all resources over the interface endpoint, select **Full access**. To restrict access, select **Custom** and enter a policy. This option is available only if the service supports VPC endpoint policies. For more information, see [Endpoint policies](./vpc-endpoints-access.html). + 12. For **Policy** , to allow all operations by all principals on all resources over the interface endpoint, select **Full access**. To restrict access, select **Custom** and enter a policy. This option is available only if the service supports VPC endpoint policies. For more information, see [Endpoint policies](./vpc-endpoints-access.html). @@ -83 +85 @@ By default, we select IP addresses from the subnet IP address ranges and assign - 12. (Optional) To add a tag, choose **Add new tag** and enter the tag key and the tag value. + 13. (Optional) To add a tag, choose **Add new tag** and enter the tag key and the tag value. @@ -85 +87 @@ By default, we select IP addresses from the subnet IP address ranges and assign - 13. Choose **Create endpoint**. + 14. Choose **Create endpoint**. @@ -113 +115 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Services that integrate +Cross-region enabled AWS services