AWS rtb-fabric documentation change
Summary
Added documentation for creating external responder gateways, expanded endpoint configuration options (Domain name, EKS, Auto Scaling groups), added multi-protocol listener configuration support (HTTP/HTTPS), and updated terminology from 'application' to 'gateway' throughout.
Security assessment
The changes add security-related documentation for HTTPS configuration, CA certificate chains, IAM role permissions for EKS and Auto Scaling groups, and TLS termination behavior. The note about HTTP connections bypassing TLS termination when both protocols are enabled highlights a security consideration. However, there is no concrete evidence this addresses a specific security vulnerability or incident; it appears to be routine feature documentation expansion.
Diff
diff --git a/rtb-fabric/latest/userguide/working-with-responder-gateways.md b/rtb-fabric/latest/userguide/working-with-responder-gateways.md index a6480e7cb..bc3cfcc5c 100644 --- a//rtb-fabric/latest/userguide/working-with-responder-gateways.md +++ b//rtb-fabric/latest/userguide/working-with-responder-gateways.md @@ -5 +5 @@ -Creating a responder gatewaySearching for responder gatewaysViewing associated linksDeleting responder gateways +Creating a responder gatewayCreating an external responder gatewaySearching for responder gatewaysViewing associated linksDeleting responder gateways @@ -9 +9 @@ Creating a responder gatewaySearching for responder gatewaysViewing associated l -Responder gateways are RTB Fabric infrastructure components that serve as connection points for customer applications. Responder gateways receive requests from requester gateways and forward them to responder applications, then return responses through the same pathway. Gateways operate colocated with your VPC and provide routing, load balancing, and processing capabilities. You maintain complete control over your bidding algorithms, response logic, and data processing, while RTB Fabric provides the secure infrastructure for connectivity. +Responder gateways are RTB Fabric infrastructure components that serve as connection points for customer gateways. Responder gateways receive requests from requester gateways and forward them to responder gateways, then return responses through the same pathway. Gateways operate colocated with your VPC and provide routing, load balancing, and processing capabilities. You maintain complete control over your bidding algorithms, response logic, and data processing, while RTB Fabric provides the secure infrastructure for connectivity. @@ -14,0 +15,2 @@ Responder gateways are RTB Fabric infrastructure components that serve as connec + * Creating an external responder gateway + @@ -50 +52,21 @@ You are responsible for the data you process through RTB Fabric, including ensur - 6. In the **Responder endpoint configuration** section, configure the endpoint where your gateway receives network traffic: + 6. In the **Responder endpoint configuration** section, choose an endpoint type from the dropdown and configure the fields for that type: + + * **Domain name** — Configure a direct endpoint using a domain name. + + 1. For **Domain name** , enter a fully qualified domain name (FQDN) where you want your gateway to be accessed. Valid characters are a-z, A-Z, 0-9, periods (.), and hyphens (-). Maximum length is 253 characters. + + 2. For **Port number** , enter the network port number where your gateway will listen for incoming traffic. Enter an integer from 1 to 65535. Common ports are 80 and 443. + + 3. For **Protocol** , select either **HTTP** or **HTTPS**. + + 4. (HTTPS only) For **CA certificate chain** , enter the CA certificate chain for your domain. Include the intermediate and root certificates in PEM format. Maximum size: 2048 characters. + + * **EKS** — Configure a managed endpoint that points to a Kubernetes cluster. + + 1. For **EKS Endpoints resource name** , enter the name of the Kubernetes Endpoints resource. Must be a DNS label with a maximum of 63 characters. + + 2. For **EKS Endpoints resource namespace** , enter the Kubernetes namespace where the Endpoints resource is located. + + 3. For **Cluster API server endpoint URI** , enter the EKS cluster API server endpoint URL. Must be a valid URI. + + 4. For **Cluster API server CA certificate** , enter the base64-encoded CA certificate chain for the EKS API server. @@ -52 +74 @@ You are responsible for the data you process through RTB Fabric, including ensur - 1. For **DNS name** , enter a fully qualified domain name (FQDN) where you want your gateway to be accessed. Valid characters are a-z, A-Z, 0-9, periods (.), and hyphens (-). Maximum length is 253 characters. + 5. For **Cluster name** , enter the name of the EKS cluster. @@ -54 +76 @@ You are responsible for the data you process through RTB Fabric, including ensur - 2. (Optional) For **CA certificate chain** , enter the CA certificate chain for your domain. Include the intermediate and root certificates in PEM format. Maximum size: 2048 characters. + 6. For **IAM role** , select an IAM role with `ec2:DescribeSubnets` permission that is associated with EKS RBAC. @@ -56 +78 @@ You are responsible for the data you process through RTB Fabric, including ensur - 3. For **Network port number** , enter the network port number where your gateway will listen for incoming traffic. Enter a number from 1 to 65535. Common ports are 80 and 443. + 7. For **Port number** , enter the network port number. Enter an integer from 1 to 65535. @@ -58 +80,19 @@ You are responsible for the data you process through RTB Fabric, including ensur - 4. For **Protocol** , choose the web protocol that your gateway will use for communication. Select either **https://** or **http://**. + 8. For **Protocol** , select either **HTTP** or **HTTPS**. + + 9. (HTTPS only) For **Domain name** , enter the fully qualified domain name for the endpoint. + + 10. (HTTPS only, optional) For **CA certificate chain** , enter the CA certificate chain in PEM format. + + * **Auto Scaling group** — Configure a managed endpoint using EC2 Auto Scaling groups. + + 1. For **Auto Scaling groups** , select one or more Auto Scaling groups that will receive traffic. + + 2. For **IAM role** , select an IAM role that grants RTB Fabric permission to discover instances in the Auto Scaling groups. + + 3. For **Port number** , enter the network port number. Enter an integer from 1 to 65535. + + 4. For **Protocol** , select either **HTTP** or **HTTPS**. + + 5. (HTTPS only) For **Domain name** , enter the fully qualified domain name for the endpoint. + + 6. (HTTPS only, optional) For **CA certificate chain** , enter the CA certificate chain in PEM format. @@ -67 +107 @@ You are responsible for the data you process through RTB Fabric, including ensur -After creating your application, you can view its details, monitor performance metrics, and make configuration changes as needed. +After creating your gateway, you can view its details, monitor performance metrics, and make configuration changes as needed. @@ -72,0 +113,19 @@ You can update the gateway description using the RTB Fabric API. For more inform +### Listener configuration + +A listener configuration defines which protocols a gateway with external links accepts for incoming traffic. By default, a gateway listens on a single protocol (HTTPS). With multiprotocol support, you can configure a gateway to accept both HTTP and HTTPS traffic simultaneously using the `listenerConfig` parameter. + +The `listenerConfig` contains a `protocols` list that specifies one or two protocols: + + * `["HTTPS"]` — The gateway accepts HTTPS traffic only (default). + + * `["HTTP", "HTTPS"]` — The gateway accepts both HTTP and HTTPS traffic. + + + + +Multi-protocol support is useful when you need to support partners that send traffic over HTTP while also serving HTTPS traffic with TLS termination. When both protocols are enabled, the gateway provisions listeners for each protocol on the public ingress cluster. + +###### Note + +If you enable both HTTP and HTTPS, TLS certificate association and SNI-based certificate resolution apply only to HTTPS connections. HTTP connections bypass TLS termination entirely. + @@ -105,0 +165,33 @@ Use the following command to create a responder gateway using the AWS Command Li +**Create with multi-protocol listener configuration (HTTP and HTTPS)** + + + $ aws rtbfabric create-responder-gateway \ + --description "My RTB responder gateway" \ + --vpc-id vpc-01f345ad6524a6d7 \ + --subnet-ids subnet-abc12345 subnet-def67890 \ + --security-group-ids sg-12345678 \ + --port 443 \ + --protocol HTTPS \ + --listener-config '{"protocols":["HTTP","HTTPS"]}' \ + --client-token "unique-client-token-123" \ + --gateway-type EXTERNAL \ + --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/MyASGRole"}}' \ + --endpoint-url https://rtbfabric.us-east-1.amazonaws.com \ + --region us-east-1 + +**Create with EKS managed endpoint configuration** + + + $ aws rtbfabric create-responder-gateway \ + --description "My EKS responder gateway" \ + --vpc-id vpc-0abc1234def567890 \ + --subnet-ids subnet-0abc1234def567890 subnet-0def5678abc901234 \ + --security-group-ids sg-0abc1234def567890 \ + --port 443 \ + --protocol HTTPS \ + --gateway-type EXTERNAL \ + --managed-endpoint-configuration '{"eksEndpoints":{"endpointsResourceName":"my-bidder-service","endpointsResourceNamespace":"bidding-ns","clusterApiServerEndpointUri":"https://ABCDEF1234567890.gr7.us-east-1.eks.amazonaws.com","clusterApiServerCaCertificateChain":"LS0tLS1CRUdJTi...base64-encoded-CA-cert...LS0tLS1FTkQ=","clusterName":"my-eks-cluster","roleArn":"arn:aws:iam::123456789012:role/MyEksEndpointDiscoveryRole"}}' \ + --client-token "550e8400-e29b-41d4-a716-446655440000" \ + --endpoint-url https://rtbfabric.us-east-1.amazonaws.com \ + --region us-east-1 + @@ -109,0 +202,64 @@ When logging is configured, default sampling behavior applies. Service logs capt +## Creating an external responder gateway + +Create an external responder gateway in RTB Fabric if you do not already have one. Inbound external links require an external gateway — a gateway type designed for receiving traffic from endpoints outside RTB Fabric. + +Use the following command to create an external responder gateway using the AWS Command Line Interface (AWS CLI). + +**Create an external responder gateway with HTTP** + + + $ aws rtbfabric create-responder-gateway \ + --description "External gateway for inbound external links" \ + --vpc-id vpc-0abc123def456 \ + --subnet-ids subnet-0abc123 subnet-0def456 \ + --security-group-ids sg-0abc123 \ + --port 80 \ + --protocol HTTP \ + --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/MyASGRole"}}' \ + --gateway-type EXTERNAL \ + --endpoint-url https://rtbfabric.us-east-1.amazonaws.com \ + --region us-east-1 + +**Create an external responder gateway with HTTPS** + + + $ aws rtbfabric create-responder-gateway \ + --description "External gateway for inbound external links" \ + --vpc-id vpc-0abc123def456 \ + --subnet-ids subnet-0abc123 subnet-0def456 \ + --security-group-ids sg-0abc123 \ + --port 443 \ + --protocol HTTPS \ + --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/MyASGRole"}}' \ + --gateway-type EXTERNAL \ + --endpoint-url https://rtbfabric.us-east-1.amazonaws.com \ + --region us-east-1 + +**Create an external responder gateway with EKS managed endpoints** + + + $ aws rtbfabric create-responder-gateway \ + --description "External gateway with EKS endpoint discovery" \ + --vpc-id vpc-0abc123def456 \ + --subnet-ids subnet-0abc123 subnet-0def456 \ + --security-group-ids sg-0abc123 \ + --port 443 \ + --protocol HTTPS \ + --managed-endpoint-configuration '{"eksEndpoints":{"endpointsResourceName":"my-bidder-service","endpointsResourceNamespace":"bidding-ns","clusterApiServerEndpointUri":"https://ABCDEF1234567890.gr7.us-east-1.eks.amazonaws.com","clusterApiServerCaCertificateChain":"LS0tLS1CRUdJTi...base64-encoded-CA-cert...LS0tLS1FTkQ=","clusterName":"my-eks-cluster","roleArn":"arn:aws:iam::123456789012:role/MyEksEndpointDiscoveryRole"}}' \ + --gateway-type EXTERNAL \ + --endpoint-url https://rtbfabric.us-east-1.amazonaws.com \ + --region us-east-1 + +**Key parameters:** + + * `--gateway-type EXTERNAL` — Required. Creates an external gateway that supports inbound external links. + + * `--managed-endpoint-configuration` — Required for external gateways. Specifies the backend that receives traffic. Provide either an `autoScalingGroups` configuration (with ASG names and a role ARN) or an `eksEndpoints` configuration (with EKS cluster details). + + * `--protocol` — `HTTP` or `HTTPS`. Choose based on whether you want TLS termination at the gateway. + + * `--port` — The port the gateway listens on (for example, `80` for HTTP or `443` for HTTPS). + + + + @@ -120 +276 @@ Use the search functionality in the console to locate specific gateways in your - 3. In the **Find responder gateways** search box, enter your search criteria to locate specific applications. + 3. In the **Find responder gateways** search box, enter your search criteria to locate specific gateways. @@ -122 +278 @@ Use the search functionality in the console to locate specific gateways in your - 4. The table automatically filters to show matching applications as you type. + 4. The table automatically filters to show matching gateways as you type. @@ -124 +280 @@ Use the search functionality in the console to locate specific gateways in your - 5. If no applications exist, the console displays **No responder gateways** with an option to create your first application. + 5. If no gateways exist, the console displays **No responder gateways** with an option to create your first gateway. @@ -143 +299 @@ Each responder gateway can have associated links that connect it to requester ga -###### To view associated links for a responder application +###### To view associated links for a responder gateway