AWS AWSEC2 documentation change
Summary
Updated connection tracking documentation to address shorter default timeouts on Nitrov6 instances, recommending configuration of TcpEstablishedTimeout and testing before production deployment.
Security assessment
This change documents security feature configuration (connection tracking timeouts) that could impact application availability if not properly configured. While it addresses a potential operational issue with connection tracking on Nitrov6 instances, there's no evidence of a specific security vulnerability being fixed.
Diff
diff --git a/AWSEC2/latest/UserGuide/security-group-connection-tracking.md b/AWSEC2/latest/UserGuide/security-group-connection-tracking.md index b37aac779..aca038e9d 100644 --- a//AWSEC2/latest/UserGuide/security-group-connection-tracking.md +++ b//AWSEC2/latest/UserGuide/security-group-connection-tracking.md @@ -70 +70,3 @@ To maintain peak performance and optimize connection management when connection - * For long-lived connections, configure TCP keep alives to be sent at intervals of less than 5 minutes to ensure connections stay open and maintain their tracked state. This helps prevent connections from being dropped due to idle timeout and reduces the overhead of connection re-establishment, especially in cases where connection timeouts may be reduced due to minimal activity. + * With the shorter default timeouts on Nitrov6 instances, applications with long-lived connections (such as database connection pools, persistent HTTP connections, or streaming workloads) should configure an appropriate `TcpEstablishedTimeout` value at instance launch. + + * For long-lived connections, configure TCP keep alives to be sent at intervals of less than 5 minutes to ensure connections stay open and maintain their tracked state. This helps prevent connections from being dropped due to idle timeout and reduces the overhead of connection re-establishment. @@ -83 +85 @@ The security group tracks each connection established to ensure that return pack -This feature is available only with [Nitro-based instances](./instance-types.html#instance-hypervisor-type). +This feature is available only with [Nitro-based instances](./instance-types.html#instance-hypervisor-type). You should test your applications on Nitrov6 generation instances with the reduced `350` second default connection tracking timeout before deploying to production.