AWS transform documentation change
Summary
Enhanced troubleshooting guide for accessing the AWS Transform WebApp from a VPC, adding specific verification steps for the required VPC endpoint and private DNS configuration.
Security assessment
The change adds detailed operational security documentation. It provides explicit commands to verify that the VPC endpoint is correctly configured with private DNS enabled, which is a security control to keep API traffic private. This helps users implement a secure architecture but does not indicate a response to a specific security vulnerability.
Diff
diff --git a/transform/latest/userguide/vpc-webapp-access.md b/transform/latest/userguide/vpc-webapp-access.md index 0d59a2090..9dc0d4877 100644 --- a//transform/latest/userguide/vpc-webapp-access.md +++ b//transform/latest/userguide/vpc-webapp-access.md @@ -19 +19 @@ The AWS Transform WebApp uses two network paths: - * **API calls** – When you interact with the webapp (starting jobs, viewing workspaces, and so on), the browser sends API requests to `api.transform.`region`.on.aws`. With AWS PrivateLink configured, these requests resolve to a private IP address in your VPC and never leave the AWS network. + * **API calls** – When you interact with the webapp (starting jobs, viewing workspaces, and so on), the browser sends API requests to `api.transform.`region`.on.aws`. With the `com.amazonaws.`region`.api.transform` VPC endpoint and private DNS enabled, these requests resolve to a private IP address in your VPC and never leave the AWS network. @@ -67 +67 @@ Before you begin, ensure you have: - * A AWS Transform VPC endpoint configured. For instructions, see [AWS Transform and interface endpoints (AWS PrivateLink)](./vpc-interface-endpoints.html). + * A AWS Transform VPC endpoint for `com.amazonaws.`region`.api.transform` with private DNS enabled. This is the endpoint used by the WebApp browser client. For instructions on creating endpoints, see [AWS Transform and interface endpoints (AWS PrivateLink)](./vpc-interface-endpoints.html). @@ -353,0 +354,20 @@ From an instance in the private subnet, verify the configuration: +API calls to api.transform are blocked by your firewall + + +The domain `api.transform.`region`.on.aws` should resolve to a private IP address via the VPC endpoint and should not reach your internet firewall. + + * Verify you have created the `com.amazonaws.`region`.api.transform` endpoint. + + * Verify private DNS is enabled on the endpoint: + + aws ec2 describe-vpc-endpoints \ + --filters "Name=service-name,Values=com.amazonaws.region.api.transform" \ + --query 'VpcEndpoints[*].[State,PrivateDnsEnabled]' \ + --output table + + +Expected output: `available | True` + + + +