AWS workspaces-web documentation change
Summary
Changed from VPC creation instructions to route table verification guidance, emphasizing proper NAT gateway and internet gateway configurations
Security assessment
The changes focus on network configuration best practices rather than addressing specific vulnerabilities. While proper route table configuration is important for security posture, there's no evidence this change addresses a specific known vulnerability or security incident. The documentation now better explains secure traffic routing patterns which could help prevent misconfigurations.
Diff
diff --git a/workspaces-web/latest/adminguide/vpc-step2.md b/workspaces-web/latest/adminguide/vpc-step2.md index 83d6be287..9a1ee0e16 100644 --- a//workspaces-web/latest/adminguide/vpc-step2.md +++ b//workspaces-web/latest/adminguide/vpc-step2.md @@ -5 +5 @@ -# Creating a new VPC +# Verifying your subnet route tables (optional) @@ -7 +7 @@ -Complete the following steps to create a new VPC with one public subnet and one private subnet. +The VPC wizard automatically configures the route tables for you. If you created your VPC manually or want to confirm the configuration, you can verify that the following details are correct for your route table: @@ -9 +9 @@ Complete the following steps to create a new VPC with one public subnet and one -###### To create a new VPC + * The route table associated with the subnet that your NAT gateway resides in must include a route that points internet traffic to an internet gateway. This ensures that your NAT gateway can access the internet. @@ -11 +11 @@ Complete the following steps to create a new VPC with one public subnet and one - 1. Open the Amazon VPC Console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). + * The route tables associated with your private subnets must be configured to point internet traffic to the NAT gateway. This enables the streaming instances in your private subnets to communicate with the internet. @@ -13 +12,0 @@ Complete the following steps to create a new VPC with one public subnet and one - 2. In the navigation pane, choose **VPC Dashboard**. @@ -15 +13,0 @@ Complete the following steps to create a new VPC with one public subnet and one - 3. Choose **Launch VPC Wizard**. @@ -17 +14,0 @@ Complete the following steps to create a new VPC with one public subnet and one - 4. In **Step 1: Select a VPC Configuration** , choose **VPC with Public and Private Subnets** , and then choose **Select**. @@ -19 +16 @@ Complete the following steps to create a new VPC with one public subnet and one - 5. In **Step 2: VPC with Public and Private Subnets** , configure the VPC as follows: +###### To verify and name your subnet route tables @@ -21 +18 @@ Complete the following steps to create a new VPC with one public subnet and one - * For **IPv4 CIDR block** , specify an IPv4 CIDR block for the VPC. + 1. In the navigation pane, choose **Subnets** , and then select a public subnet. For example, **WSB-VPC-subnet-public1-us-east-1a**. @@ -23 +20 @@ Complete the following steps to create a new VPC with one public subnet and one - * For **IPv6 CIDR block** , keep the default value, **No IPv6 CIDR Block**. + 2. On the **Route Table** tab, choose the ID of the route table. For example, **rtb-12345678**. @@ -25 +22 @@ Complete the following steps to create a new VPC with one public subnet and one - * For **VPC name** , enter a unique name for the VPC. + 3. Select the route table. Under **Name** , choose the edit (pencil) icon, and enter a name for the table. For example, enter the name `workspacesweb-public-routetable`. Then select the check mark to save the name. @@ -27 +24 @@ Complete the following steps to create a new VPC with one public subnet and one - * Configure the public subnet as follows: + 4. With the public route table still selected, on the **Routes** tab, verify that there are two routes: one for local traffic, and one that sends all other traffic through the VPC's internet gateway. The following table describes these two routes: @@ -29 +26,4 @@ Complete the following steps to create a new VPC with one public subnet and one - * For **Public subnet's IPv4 CIDR** , specify the CIDR block for the subnet. +Destination | Target | Description +---|---|--- +Public subnet IPv4 CIDR block (for example, 10.0.0/20) | Local | All traffic from the resources destined for IPv4 addresses within the public subnet IPv4 CIDR block. This traffic is routed locally within the VPC. +Traffic destined to all other IPv4 addresses (for example, 0.0.0.0/0) | Outbound (igw-ID) | Traffic destined for all other IPv4 addresses is routed to the internet gateway (identified by igw-ID) that was created by the VPC wizard. @@ -31 +31 @@ Complete the following steps to create a new VPC with one public subnet and one - * For **Availability Zone** , keep the default value, **No Preference**. + 5. In the navigation pane, choose **Subnets**. Then, select a private subnet (for example, `WSB-VPC-subnet-private1-us-east-1a`). @@ -33 +33 @@ Complete the following steps to create a new VPC with one public subnet and one - * For **Public subnet name** , enter a name for the subnet. For example, `WorkSpaces Secure Browser Public Subnet`. + 6. On the **Route Table** tab, choose the route table's ID. @@ -35 +35 @@ Complete the following steps to create a new VPC with one public subnet and one - * Configure the first private subnet as follows: + 7. Select the route table. Under **Name** , choose the edit (pencil) icon, and enter a name for the table. For example, enter the name `WSB-VPC-private-routetable`. Then choose the check mark to save the name. @@ -37 +37 @@ Complete the following steps to create a new VPC with one public subnet and one - * For **Private subnet's IPv4 CIDR** , specify the CIDR block for the subnet. Make a note of the value that you specify. + 8. On the **Routes** tab, verify that the route table includes the following routes: @@ -39 +39,5 @@ Complete the following steps to create a new VPC with one public subnet and one - * For **Availability Zone** , select a specific zone and make a note of the zone that you select. +Destination | Target | Description +---|---|--- +Public subnet IPv4 CIDR block (for example, 10.0.0/20) | Local | All traffic from the resources destined for IPv4 addresses within the public subnet IPv4 CIDR block is routed locally within the VPC. +Traffic destined to all other IPv4 addresses (for example, 0.0.0.0/0) | Outbound (nat-ID) | Traffic destined for all other IPv4 addresses is routed to the NAT gateway (identified by nat-ID). +Traffic destined for S3 buckets (applicable if you specified an S3 endpoint) [pl-ID (com.amazonaws.region.s3)] | Storage (vpce-ID) | Traffic destined for S3 buckets is routed to the S3 endpoint (identified by vpce-ID). @@ -41 +45 @@ Complete the following steps to create a new VPC with one public subnet and one - * For **Private subnet name** , enter a name for the subnet. For example, `WorkSpaces Secure Browser Private Subnet1`. + 9. In the navigation pane, choose **Subnets**. Then select the second private subnet that you created (for example, `WorkSpaces Secure Browser Private Subnet2`). @@ -43,23 +47 @@ Complete the following steps to create a new VPC with one public subnet and one - * For the remaining fields, keep the default values where applicable. - - * For **Elastic IP Allocation ID** , enter the value that corresponds to the Elastic IP address that you created. This address is then assigned to the NAT gateway. If you don't have an Elastic IP address, create one by using the Amazon VPC Console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). - - * For **Service endpoints** , if an Amazon S3 endpoint is required for your environment, specify one. - -To specify an Amazon S3 endpoint, do the following: - - 1. Choose **Add Endpoint**. - - 2. For **Service** , select the **com.amazonaws.`Region`.s3** entry, where `Region` is the AWS Region you're creating your VPC in. - - 3. For **Subnet** , choose **Private subnet**. - - 4. For **Policy** , keep the default value, **Full Access**. - - * For **Enable DNS hostnames** , keep the default value, **Yes**. - - * For **Hardware tenancy** , keep the default value, **Default**. - - * Choose **Create VPC**. - - * It takes several minutes to set up your VPC. After the VPC is created, choose **OK**. + 10. On the **Route Table** tab, verify that the selected route table is the private route table (for example, `workspacesweb-private-routetable`). If the route table is different, choose **Edit** and select your private route table instead. @@ -76 +58 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Elastic IP address +Quick VPC Setup @@ -78 +60 @@ Elastic IP address -Second private subnet +Enabling internet browsing