AWS cli documentation change
Summary
Added documentation for new '--player-gateway-mode' and '--player-gateway-configuration' parameters related to DDoS protection features
Security assessment
The changes document new player gateway functionality that provides DDoS protection through traffic validation/rate limiting and IP address hiding. While this is a security feature, there is no evidence this addresses a specific existing vulnerability (it appears to be a new capability rather than a fix).
Diff
diff --git a/cli/latest/reference/gamelift/create-fleet.md b/cli/latest/reference/gamelift/create-fleet.md index 2ed1dc0a2..9d1b16611 100644 --- a//cli/latest/reference/gamelift/create-fleet.md +++ b//cli/latest/reference/gamelift/create-fleet.md @@ -15 +15 @@ - * [AWS CLI 2.34.1 Command Reference](../../index.html) » + * [AWS CLI 2.34.4 Command Reference](../../index.html) » @@ -138,0 +139,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/gameli + [--player-gateway-mode <value>] + [--player-gateway-configuration <value>] @@ -1292,0 +1295,51 @@ JSON Syntax: +`--player-gateway-mode` (string) + +> Configures player gateway for your fleet. Player gateway provides benefits such as DDoS protection by rate limiting and validating traffic before it reaches game servers, hiding game server IP addresses from players, and providing updated endpoints when relay endpoints become unhealthy. Note, player gateway is only available for fleets using server SDK 5.x or later game server builds. +> +>> **How it works:** When enabled, game clients connect to relay endpoints instead of to your game servers. Player gateway validates player gateway tokens and routes traffic to the appropriate game server. Your game backend calls [GetPlayerConnectionDetails](https://docs.aws.amazon.com/gamelift/latest/apireference/API_GetPlayerConnectionDetails.html) to retrieve relay endpoints and player gateway tokens for your game clients. To learn more about this topic, see [DDoS protection with Amazon GameLift Servers player gateway](https://docs.aws.amazon.com/gameliftservers/latest/developerguide/ddos-protection-intro.html) . +> +> Possible values include: +> +> * `DISABLED` (default) – Game clients connect to the game server endpoint. Use this when you do not intend to integrate your game with player gateway. +> * `ENABLED` – Player gateway is available in fleet locations where it is supported. Your game backend can call [GetPlayerConnectionDetails](https://docs.aws.amazon.com/gamelift/latest/apireference/API_GetPlayerConnectionDetails.html) to obtain a player gateway token and endpoints for game clients. +> * `REQUIRED` – Player gateway is available in fleet locations where it is supported, and the fleet can only use locations that support this feature. Attempting to add a remote location to your fleet which does not support player gateway will result in an `InvalidRequestException` . +> + +> +> Possible values: +> +> * `DISABLED` +> * `ENABLED` +> * `REQUIRED` +> + + +`--player-gateway-configuration` (structure) + +> Configuration settings for player gateway. Use this to specify advanced options for how player gateway handles connections. +> +> GameServerIpProtocolSupported -> (string) +> +>> The IP protocol that your game servers support for player connections through player gateway. If the value is set to `IPv4` , GameLift will install and execute a lightweight IP translation software on fleet instances to receive and transform incoming IPv6 traffic to IPv4. If the value is set to `DUAL_STACK` , the lightweight IP translation software will not be installed on fleet instances. `DUAL_STACK` provides slightly better performance than `IPv4` . +>> +>> Possible values: +>> +>> * `IPv4` +>> * `DUAL_STACK` +>> + + +Shorthand Syntax: + + + GameServerIpProtocolSupported=string + + +JSON Syntax: + + + { + "GameServerIpProtocolSupported": "IPv4"|"DUAL_STACK" + } + + @@ -2449,0 +2503,29 @@ FleetAttributes -> (structure) +> +> PlayerGatewayMode -> (string) +> +>> Indicates whether player gateway is enabled for this fleet. Player gateway provides benefits such as DDoS protection with negligible impact to latency. +>> +>> If `ENABLED` or `REQUIRED` , game clients can use player gateway to connect with the game server. If `DISABLED` , game clients cannot use player gateway. Instead, they have to directly connect to the game server. +>> +>> Possible values: +>> +>> * `DISABLED` +>> * `ENABLED` +>> * `REQUIRED` +>> + +> +> PlayerGatewayConfiguration -> (structure) +> +>> Configuration settings for player gateway on this fleet. +>> +>> GameServerIpProtocolSupported -> (string) +>> +>>> The IP protocol that your game servers support for player connections through player gateway. If the value is set to `IPv4` , GameLift will install and execute a lightweight IP translation software on fleet instances to receive and transform incoming IPv6 traffic to IPv4. If the value is set to `DUAL_STACK` , the lightweight IP translation software will not be installed on fleet instances. `DUAL_STACK` provides slightly better performance than `IPv4` . +>>> +>>> Possible values: +>>> +>>> * `IPv4` +>>> * `DUAL_STACK` +>>> + @@ -2498,0 +2581,18 @@ LocationStates -> (list) +>> +>> PlayerGatewayStatus -> (string) +>> +>>> The current status of player gateway in this location for this fleet. Note, even if a fleet has PlayerGatewayMode configured as `ENABLED` , player gateway might not be available in a specific location. For more information about locations where player gateway is supported, see [Amazon GameLift Servers service locations](https://docs.aws.amazon.com/gameliftservers/latest/developerguide/gamelift-regions.html) . +>>> +>>> Possible values include: +>>> +>>> * `ENABLED` – Player gateway is available for this fleet location. +>>> * `DISABLED` – Player gateway is not available for this fleet location. +>>> + +>>> +>>> Possible values: +>>> +>>> * `DISABLED` +>>> * `ENABLED` +>>> + @@ -2510 +2610 @@ LocationStates -> (list) - * [AWS CLI 2.34.1 Command Reference](../../index.html) » + * [AWS CLI 2.34.4 Command Reference](../../index.html) »