AWS appconfig medium security documentation change
Summary
Added HTTP_HOST configuration details for network binding security in EC2 environments.
Security assessment
Documents security-critical network binding defaults (127.0.0.1 and ::1) that prevent public exposure of the agent. Directly addresses potential misconfiguration risks by enforcing localhost binding.
Diff
diff --git a/appconfig/latest/userguide/appconfig-integration-ec2.md b/appconfig/latest/userguide/appconfig-integration-ec2.md index 4c5fe627c..060a549fa 100644 --- a//appconfig/latest/userguide/appconfig-integration-ec2.md +++ b//appconfig/latest/userguide/appconfig-integration-ec2.md @@ -224,0 +225,18 @@ Configurations backed up to disk are not encrypted. If your configuration contai +`HTTP_HOST` | The HTTP_HOST variable controls how the AWS AppConfig Agent binds to network interfaces. The binding behavior differs based on the runtime environment to ensure optimal security and accessibility. | ECS, EKS + + * Default binding: All network interfaces (0.0.0.0) + +EC2 and on-prem + + * Default binding: localhost only + * IPv4 address: 127.0.0.1:2772 + * IPv6 address: [::1]:2772 + +| Custom Configuration Options. You can override the default behavior using these values: + + * ` all` (binds to all interfaces) + * `localhost`(explicitly binds to localhost interfaces) + * Specific IP address (e.g `192.168.1.1`) + * Custom hostname + +