AWS config documentation change
Summary
Enhanced rule description for public IP assignment checks with IPv6 clarification
Security assessment
Improves security documentation by clarifying IPv6 handling in public IP assignment checks. Adds warning about GUA ranges but doesn't fix specific vulnerability.
Diff
diff --git a/config/latest/developerguide/subnet-auto-assign-public-ip-disabled.md b/config/latest/developerguide/subnet-auto-assign-public-ip-disabled.md index 3f6eadfc5..10d9297c5 100644 --- a//config/latest/developerguide/subnet-auto-assign-public-ip-disabled.md +++ b//config/latest/developerguide/subnet-auto-assign-public-ip-disabled.md @@ -9 +9,5 @@ Proactive EvaluationAWS CloudFormation template -Checks if Amazon Virtual Private Cloud (Amazon VPC) subnets are assigned a public IP address. The rule is COMPLIANT if Amazon VPC does not have subnets that are assigned a public IP address. The rule is NON_COMPLIANT if Amazon VPC has subnets that are assigned a public IP address. +Checks if Amazon Virtual Private Cloud (Amazon VPC) subnets are configured to automatically assign public IP addresses to instances launched within them. This rule is COMPLIANT if subnets do not auto-assign public IPv4 or IPv6 addresses. This rule is NON_COMPLIANT if subnets auto-assign public IPv4 or IPv6 addresses. + +###### Warning + +This rule does not distinguish between private and public Global Unicast Address (GUA) IPv6 ranges and will treat all GUA ranges as violations when auto-assignment is enabled.