AWS vpn documentation change
Summary
Added documentation for enabling BGP logging on VPN tunnels and updated terminology from 'tunnel logging' to 'tunnel activity logging'
Security assessment
The change adds documentation about enabling BGP logging, which is a security monitoring feature that helps track routing protocol activity. This improves visibility but doesn't address a specific known vulnerability.
Diff
diff --git a/vpn/latest/s2svpn/enable-logs.md b/vpn/latest/s2svpn/enable-logs.md index afe7bdb80..12f592b96 100644 --- a//vpn/latest/s2svpn/enable-logs.md +++ b//vpn/latest/s2svpn/enable-logs.md @@ -26 +26 @@ Follow the procedure [Step 5: Create a VPN connection](./SetUpVPNConnections.htm -###### To enable tunnel logging on an existing Site-to-Site VPN connection +###### To enable tunnel activity logging on an existing Site-to-Site VPN connection @@ -50,0 +51,25 @@ Follow the procedure [Step 5: Create a VPN connection](./SetUpVPNConnections.htm +###### To enable tunnel BGP logging on an existing Site-to-Site VPN connection + + 1. Open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). + + 2. In the navigation pane, choose **Site-to-Site VPN connections**. + + 3. Select the VPN connection that you want to modify from the **VPN connections** list. + + 4. Select **Actions** , **Modify VPN tunnel options**. + + 5. Select the tunnel that you want to modify by choosing the appropriate IP address from the **VPN tunnel outside IP address** list. + + 6. Under **Tunnel BGP log** , select **Enable**. + + 7. Under **Amazon CloudWatch log group** , select the Amazon CloudWatch log group where you want the logs to be sent. + + 8. (Optional) Under **Output format** , choose the desired format for the log output, either **json** or **text**. + + 9. Select **Save changes**. + + 10. (Optional) Repeat steps 4 through 9 for the other tunnel if desired. + + + +