AWS transform documentation change
Summary
Updated VPC endpoint documentation for AWS Transform, clarifying service names and adding a specific requirement for the WebApp endpoint to have private DNS enabled.
Security assessment
The change adds explicit documentation for a security feature (AWS PrivateLink VPC endpoints) and specifies a configuration requirement (enabling private DNS) to ensure API traffic for the WebApp remains within the private AWS network. This enhances security posture by preventing data exfiltration over the public internet, but there is no evidence it addresses a specific, disclosed security issue.
Diff
diff --git a/transform/latest/userguide/vpc-interface-endpoints.md b/transform/latest/userguide/vpc-interface-endpoints.md index 953bca765..bda96c3cc 100644 --- a//transform/latest/userguide/vpc-interface-endpoints.md +++ b//transform/latest/userguide/vpc-interface-endpoints.md @@ -19,4 +18,0 @@ For more information, see [Interface VPC endpoints (AWS PrivateLink)](https://do -The AWS Transform WebApp requires additional network configuration to access from a VPC. For instructions, see [Accessing the AWS Transform WebApp from a VPC](./vpc-webapp-access.html). - -###### Note - @@ -46 +42,3 @@ You can create a VPC endpoint for the AWS Transform service using either the Ama -Create the following VPC endpoints for AWS Transform using this service name: +The following VPC endpoint service names are available for AWS Transform: + + * `com.amazonaws.`region`.transform` @@ -48 +46 @@ Create the following VPC endpoints for AWS Transform using this service name: - * com.amazonaws.`region`.transform + * `com.amazonaws.`region`.api.transform` – Required for the AWS Transform WebApp. This endpoint **must** have private DNS enabled (the _Enable DNS name_ option) so that `api.transform.`region`.on.aws` resolves to a private IP address in your VPC. @@ -53 +51,5 @@ Create the following VPC endpoints for AWS Transform using this service name: -Replace `region` with AWS Region where your AWS Transform profile is installed, for example, _com.amazonaws.us-east-1.transform_. +Replace `region` with the AWS Region where your AWS Transform profile is installed, for example, _com.amazonaws.us-east-1.transform_. + +###### Note + +If you use the AWS Transform WebApp, the `api.transform` endpoint is required. For the full setup guide, see [Accessing the AWS Transform WebApp from a VPC](./vpc-webapp-access.html).