AWS global-accelerator high security documentation change
Summary
Added detailed warnings about security controls bypassed when client IP preservation is enabled
Security assessment
Explicitly documents that enabling client IP preservation bypasses critical security controls (GWLB inspection, Network Firewall, NACLs). This addresses security implications of the feature by warning about reduced security posture.
Diff
diff --git a/global-accelerator/latest/dg/preserve-client-ip-address.how-to-enable-preservation.md b/global-accelerator/latest/dg/preserve-client-ip-address.how-to-enable-preservation.md index 355616362..35f3b2f2c 100644 --- a//global-accelerator/latest/dg/preserve-client-ip-address.how-to-enable-preservation.md +++ b//global-accelerator/latest/dg/preserve-client-ip-address.how-to-enable-preservation.md @@ -14 +14,14 @@ When you plan for adding client IP address preservation, be aware of the followi - * Global Accelerator does not support Gateway Load Balancer inspection between Global Accelerator and an endpoint when client IP address preservation is enabled. +###### Important + +When client IP address preservation is enabled, traffic bypasses the following security controls: + + * **Gateway Load Balancer (GWLB) inspection:** Traffic does not flow through GWLB endpoints, preventing inspection by third-party security appliances. + + * **AWS Network Firewall:** Network traffic filtering and intrusion prevention rules are not applied to this traffic. + + * **Network Access Control Lists (NACLs):** Subnet-level allow and deny rules are not evaluated for this traffic. + + + + + * VPC Block Public Access is supported with client IP address preservation.