AWS vpc medium security documentation change
Summary
Updated flow log documentation with regional NAT gateway details, added encryption status field, and expanded reject reasons to include VPC encryption controls
Security assessment
Added 'EC' reject reason related to VPC Endpoint encryption controls and introduced 'encryption-status' field documenting traffic encryption levels. These changes directly document security enforcement mechanisms and encryption monitoring capabilities.
Diff
diff --git a/vpc/latest/userguide/flow-log-records.md b/vpc/latest/userguide/flow-log-records.md index f6d804d2e..4b4ffac26 100644 --- a//vpc/latest/userguide/flow-log-records.md +++ b//vpc/latest/userguide/flow-log-records.md @@ -56,3 +56,3 @@ account-id | The AWS account ID of the owner of the source network interface fo -interface-id | The ID of the network interface for which the traffic is recorded. **Parquet data type:** STRING | 2 -srcaddr | For incoming traffic, this is the IP address of the source of traffic. For outgoing traffic, this is the private IPv4 address or the IPv6 address of the network interface sending the traffic. See also pkt-srcaddr. **Parquet data type:** STRING | 2 -dstaddr | The destination address for outgoing traffic, or the IPv4 or IPv6 address of the network interface for incoming traffic on the network interface. The IPv4 address of the network interface is always its private IPv4 address. See also pkt-dstaddr. **Parquet data type:** STRING | 2 +interface-id | The ID of the network interface for which the traffic is recorded. Returns a '-' symbol for flows associated with a regional NAT gateway. **Parquet data type:** STRING | 2 +srcaddr | For incoming traffic, this is the IP address of the source of traffic. For outgoing traffic, this is the private IPv4 address or the IPv6 address of the network interface sending the traffic. For outgoing traffic from regional NAT gateway, this is the same packet-level source IP address as in pkt-srcaddr. See also pkt-srcaddr. **Parquet data type:** STRING | 2 +dstaddr | The destination address for outgoing traffic, or the IPv4 or IPv6 address of the network interface for incoming traffic on the network interface. The IPv4 address of the network interface is always its private IPv4 address. For incoming traffic to regional NAT gateway, this is the same packet-level destination IP address as in pkt-dstaddr. See also pkt-dstaddr. **Parquet data type:** STRING | 2 @@ -80 +80 @@ vpc-id | The ID of the VPC that contains the network interface for which the tr -subnet-id | The ID of the subnet that contains the network interface for which the traffic is recorded. **Parquet data type:** STRING | 3 +subnet-id | The ID of the subnet that contains the network interface for which the traffic is recorded. Returns a '-' symbol for flows associated with regional NAT gateway. **Parquet data type:** STRING | 3 @@ -122 +122,18 @@ ecs-task-id | ID of the ECS task if the traffic is from a running ECS task. To i -reject-reason | Reason why traffic was rejected. Possible values: BPA. Returns a '-' for any other reject reason. For more information about VPC Block Public Access (BPA), see [Block public access to VPCs and subnets](./security-vpc-bpa.html). **Parquet data type:** STRING | 8 +reject-reason | Reason why traffic was rejected. Possible values: BPA, EC. Returns a '-' for any other reject reason. + + * BPA — For more information about VPC Block Public Access (BPA), see [Block public access to VPCs and subnets](./security-vpc-bpa.html). + * EC — The flow is rejected by VPC Endpoint due to encryption controls. For more information about VPC Encryption Controls, see [Enforce VPC encryption in transit](./vpc-encryption-controls.html). + +**Parquet data type:** STRING | 8 +resource-id | The ID of the regional NAT gateway that contains the network interface for which the traffic is recorded. Returns a '-' symbol for traffic flows not associated with a regional NAT gateway. For more information about regional NAT gateways, see [Regional NAT gateways for automatic multi-AZ expansion](./nat-gateways-regional.html). **Parquet data type:** STRING | 9 +encryption-status | Encryption status of the flow. For more information about VPC Encryption Controls, see [Enforce VPC encryption in transit](./vpc-encryption-controls.html). The possible values are: + + * 0 — not encrypted. + * 1 — nitro-encrypted. It's encrypted by the [Nitro system hardware](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/data-protection.html#encryption-transit). + * 2 — application-encrypted. Only the following are considered as application-encrypted: + * flows on TCP port 443 for interface endpoint to AWS service + * flows on TCP port 443 for gateway endpoint + * flows to encrypted Redshift cluster via VPC endpoint + * 3 — nitro-encrypted and application-encrypted. + +The value is '-' if VPC Encryption Controls is not enabled, or if FlowLog cannot get the status. **Parquet data type:** INT_32 | 10