AWS vpc documentation change
Summary
Updated NAT gateway documentation to differentiate between zonal and regional NAT gateways, including new examples and explanations for regional NAT gateway traffic flow logging
Security assessment
The changes clarify NAT gateway types and their flow log behaviors but do not address any security vulnerabilities or weaknesses. The updates provide operational documentation about traffic path visibility rather than security fixes or new security features.
Diff
diff --git a/vpc/latest/userguide/flow-logs-records-examples.md b/vpc/latest/userguide/flow-logs-records-examples.md index 1ae45a014..72a9664f5 100644 --- a//vpc/latest/userguide/flow-logs-records-examples.md +++ b//vpc/latest/userguide/flow-logs-records-examples.md @@ -5 +5 @@ -Accepted and rejected trafficNo data and skipped recordsSecurity group and network ACL rulesIPv6 trafficTCP flag sequenceTraffic through a NAT gatewayTraffic through a transit gatewayService name, traffic path, and flow direction +Accepted and rejected trafficNo data and skipped recordsSecurity group and network ACL rulesIPv6 trafficTCP flag sequenceTraffic through a zonal NAT gatewayTraffic through a regional NAT gatewayTraffic through a transit gatewayService name, traffic path, and flow direction @@ -25 +25,3 @@ For information about flow log record format, see [Flow log records](./flow-log- - * Traffic through a NAT gateway + * Traffic through a zonal NAT gateway + + * Traffic through a regional NAT gateway @@ -127 +129 @@ For short connections (for example, a few seconds) that are opened and closed wi -## Traffic through a NAT gateway +## Traffic through a zonal NAT gateway @@ -129 +131 @@ For short connections (for example, a few seconds) that are opened and closed wi -In this example, an instance in a private subnet accesses the internet through a NAT gateway that's in a public subnet. +In this example, an instance in a private subnet accesses the internet through a zonal NAT gateway that's in a public subnet. @@ -131 +133 @@ In this example, an instance in a private subnet accesses the internet through a - + @@ -133 +135 @@ In this example, an instance in a private subnet accesses the internet through a -The following custom flow log for the NAT gateway network interface captures the following fields in the following order. +The following custom flow log for the zonal NAT gateway network interface captures the following fields in the following order. @@ -138 +140 @@ The following custom flow log for the NAT gateway network interface captures the -The flow log shows the flow of traffic from the instance IP address (10.0.1.5) through the NAT gateway network interface to a host on the internet (203.0.113.5). The NAT gateway network interface is a requester-managed network interface, therefore the flow log record displays a '-' symbol for the instance-id field. The following line shows traffic from the source instance to the NAT gateway network interface. The values for the dstaddr and pkt-dstaddr fields are different. The dstaddr field displays the private IP address of the NAT gateway network interface, and the pkt-dstaddr field displays the final destination IP address of the host on the internet. +The flow log shows the flow of traffic from the instance IP address (10.0.1.5) through the zonal NAT gateway network interface to a host on the internet (203.0.113.5). The zonal NAT gateway network interface is a requester-managed network interface, therefore the flow log record displays a '-' symbol for the instance-id field. The following line shows traffic from the source instance to the zonal NAT gateway network interface. The values for the dstaddr and pkt-dstaddr fields are different. The dstaddr field displays the private IP address of the zonal NAT gateway network interface, and the pkt-dstaddr field displays the final destination IP address of the host on the internet. @@ -143 +145 @@ The flow log shows the flow of traffic from the instance IP address (10.0.1.5) t -The next two lines show the traffic from the NAT gateway network interface to the target host on the internet, and the response traffic from the host to the NAT gateway network interface. +The next two lines show the traffic from the zonal NAT gateway network interface to the target host on the internet, and the response traffic from the host to the NAT gateway network interface. @@ -149 +151 @@ The next two lines show the traffic from the NAT gateway network interface to th -The following line shows the response traffic from the NAT gateway network interface to the source instance. The values for the srcaddr and pkt-srcaddr fields are different. The srcaddr field displays the private IP address of the NAT gateway network interface, and the pkt-srcaddr field displays the IP address of the host on the internet. +The following line shows the response traffic from the zonal NAT gateway network interface to the source instance. The values for the srcaddr and pkt-srcaddr fields are different. The srcaddr field displays the private IP address of the zonal NAT gateway network interface, and the pkt-srcaddr field displays the IP address of the host on the internet. @@ -154 +156 @@ The following line shows the response traffic from the NAT gateway network inter -You create another custom flow log using the same set of fields as above. You create the flow log for the network interface for the instance in the private subnet. In this case, the instance-id field returns the ID of the instance that's associated with the network interface, and there is no difference between the dstaddr and pkt-dstaddr fields and the srcaddr and pkt-srcaddr fields. Unlike the network interface for the NAT gateway, this network interface is not an intermediate network interface for traffic. +You create another custom flow log using the same set of fields as above. You create the flow log for the network interface for the instance in the private subnet. In this case, the instance-id field returns the ID of the instance that's associated with the network interface, and there is no difference between the dstaddr and pkt-dstaddr fields and the srcaddr and pkt-srcaddr fields. Unlike the network interface for the zonal NAT gateway, this network interface is not an intermediate network interface for traffic. @@ -159,0 +162,33 @@ You create another custom flow log using the same set of fields as above. You cr +## Traffic through a regional NAT gateway + +A regional NAT gateway can connect to multiple subnets across different Availability Zones. In this example, two instances in private subnets from two different Availability Zones access the internet through the same regional NAT gateway. The following flow logs show traffic from one of the instances to the internet through the regional NAT gateway. + + + +The following custom flow log for the regional NAT gateway captures the following fields in the following order. + + + resource-id instance-id interface-id subnet-id srcaddr dstaddr pkt-srcaddr pkt-dstaddr + +The flow log shows the flow of traffic from the instance IP address (10.0.1.5) through the regional NAT gateway to a host on the internet (203.0.113.5). instance-id, interface-id, and subnet-id don’t apply to the regional NAT gateway. Therefore, the flow log record displays a '-' symbol for these fields. Instead, the resource-id field displays the ID of the regional NAT gateway. The dstaddr and pkt-dstaddr fields display the final destination IP address of the host on the internet. + + + nat-1234567890abcdef - - - 10.0.1.5 203.0.113.5 10.0.1.5 203.0.113.5 + +The next two lines show the traffic from the regional NAT gateway (public IP address 107.22.182.139) to the target host on the internet, and the response traffic from the host to the regional NAT gateway. + + + nat-1234567890abcdef - - - 107.22.182.139 203.0.113.5 107.22.182.139 203.0.113.5 + nat-1234567890abcdef - - - 203.0.113.5 107.22.182.139 203.0.113.5 107.22.182.139 + +The following line shows the response traffic from the regional NAT gateway to the source instance. The srcaddr and pkt-srcaddr fields display the IP address of the host on the internet. + + + nat-1234567890abcdef - - - 203.0.113.5 10.0.1.5 203.0.113.5 10.0.1.5 + +You create another custom flow log using the same set of fields as above. You create the flow log for the network interface for the instance in the private subnet. In this case, the instance-id field returns the ID of the instance that's associated with the network interface, and the resource-id is '-'. There is no difference between the dstaddr and pkt-dstaddr fields and the srcaddr and pkt-srcaddr fields. + + + - i-01234567890123456 eni-1111aaaa2222bbbb3 subnet-aaaaaaaa012345678 10.0.1.5 203.0.113.5 10.0.1.5 203.0.113.5 #Traffic from the source instance to host on the internet + - i-01234567890123456 eni-1111aaaa2222bbbb3 subnet-aaaaaaaa012345678 203.0.113.5 10.0.1.5 203.0.113.5 10.0.1.5 #Response traffic from host on the internet to the source instance +