AWS vpc documentation change
Summary
Updated Transit Gateway encryption documentation: Clarified relationship between VPC Encryption Controls and Transit Gateway Encryption Support, removed requirement for attached VPCs to be in monitor mode, and deleted redundant notes.
Security assessment
Changes clarify encryption behavior between VPCs in different modes but show no evidence of addressing a specific vulnerability. Removal of monitor mode requirement suggests service capability improvement rather than security fix.
Diff
diff --git a/vpc/latest/tgw/tgw-encryption-support.md b/vpc/latest/tgw/tgw-encryption-support.md index f82a89715..4bba456ca 100644 --- a//vpc/latest/tgw/tgw-encryption-support.md +++ b//vpc/latest/tgw/tgw-encryption-support.md @@ -9 +9 @@ Transit Gateway Encryption Support and VPC Encryption Control -Encryption Support on Transit Gateway allows you to enforce encryption-in-transit for all traffic on VPCs attached to your Transit Gateway. When Encryption support is enabled on the TGW, the transit gateway traffic will be encrypted between VPCs that are in Enforce mode. Traffic to VPCs that don’t have Encryption Controls turned on, or are in Monitor mode, TGW is guaranteed to encrypt traffic upto the TGW attachment in the VPC. Beyond that, it depends on the instance the traffic is being sent to in the VPC. +Encryption Controls allows you to audit the encryption status of the traffic flows in your VPC and then enforce encryption-in-transit for all traffic within the VPC. When VPC Encryption Control is in enforce mode, all Elastic Network Interfaces (ENI) in that VPC will be restricted to attach only to AWS Nitro encryption capable instances; and only AWS services that encrypt data in transit will be allowed to attach to Encryption Controls enforced VPC. For more information on VPC Encryption Controls, please refer to this [documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-encryption-controls.html). @@ -13 +13 @@ Encryption Support on Transit Gateway allows you to enforce encryption-in-transi -Encryption Controls allows you to audit the encryption status of the traffic flows in their VPC and then enforce encryption-in-transit for all traffic on their VPC. When VPC EC is enforced, all Elastic Network Interfaces (ENI) in that VPC will be restricted to attach only to AWS Nitro encryption capable instances; and only AWS services that encrypt data in transit will be allowed to attach to EC enforced VPC. +Encryption Support on Transit Gateway allows you to enforce encryption-in-transit for traffic between VPCs attached to a Transit Gateway. You will need to manually activate Encryption Support on the Transit Gateway using the [modify-transit-gateway](https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-transit-gateway.html) command to encrypt traffic between the VPCs. Once enabled, all traffic will traverse 100% encrypted links between VPCs that are in Enforce mode (without exclusions) through the Transit Gateway. You can also connect VPCs that don’t have Encryption Controls turned on, or are in Monitor mode through a Transit Gateway that has Encryption Support enabled. In this scenario Transit Gateway is guaranteed to encrypt traffic up to the Transit Gateway attachment in the VPC not running in enforce mode. Beyond that, it depends on the instance the traffic is being sent to in the VPC not running in enforce mode. @@ -15,3 +15 @@ Encryption Controls allows you to audit the encryption status of the traffic flo -To support the end to end encryption of data between VPCs through the TGW, the transit gateway attached to the VPC should also have Encryption Support enabled. Transit gateway provides you with the option to enable encryption-in-transit capabilities by using AWS Nitro encryption capable instances. - -You can only add encryption support to an existing transit gateway and not while you're creating one. As the TGW transitions to Encryption Support Enabled, there will be no downtime on the TGW or the attachments. The migration is seamless and transparent with no traffic being dropped. For the steps to modify a transit gateway to add Encryption Support, see [Modify a transit gateway](./tgw-modifying.html#tgw-modifying.title). +You can only add encryption support to an existing transit gateway and not while you're creating one. As the Transit Gateway transitions to Encryption Support Enabled state, there will be no downtime on the Transit Gateway or the attachments. The migration is seamless and transparent with no traffic being dropped. For the steps to modify a transit gateway to add Encryption Support, see [Modify a transit gateway](./tgw-modifying.html#tgw-modifying.title). @@ -23,2 +20,0 @@ Before enabling encryption support on a transit gateway, ensure that: - * All VPCs attached to the transit gateway must be in monitor mode - @@ -40,4 +35,0 @@ Before enabling encryption support on a transit gateway, ensure that: -###### Note - -You can enable Encryption Support on a Transit Gateway to encrypt traffic between your VPCs that have encryption controls turned on (in either Monitor mode or enforce mode). To enable encryption on existing TGWs that have VPCs attached to it, you need to enable VPC Encryption Controls in Monitor Mode in all associated VPCs before enabling Encryption Support on the TGW. Once TGW Encryption Support is **enabled** , you can then modify compliant VPCs to Enforce mode. Unconnected VPCs that are in enforce mode can be connected via a new TGW that has encryption support **enabled**. -