AWS vpc medium security documentation change
Summary
Updated transit gateway encryption prerequisites and limitations: added Client VPN attachment restriction and expanded unsupported attachment types list.
Security assessment
The change explicitly adds Client VPN attachments to encryption exclusions and expands unsupported features list. This addresses potential security gaps by preventing misconfiguration that could expose unencrypted traffic through Client VPN, Network Firewall, or VPN Concentrator attachments when encryption is enabled.
Diff
diff --git a/vpc/latest/tgw/tgw-encryption-support.md b/vpc/latest/tgw/tgw-encryption-support.md index de8edb8d5..ead3b2fb4 100644 --- a//vpc/latest/tgw/tgw-encryption-support.md +++ b//vpc/latest/tgw/tgw-encryption-support.md @@ -30,0 +31,2 @@ Before enabling encryption support on a transit gateway, ensure that: + * The transit gateway doesn't have Client VPN attachments + @@ -63 +65 @@ When a transit gateway has Encryption support enabled, the following attachment - * Connect attachments, peering attachments, security group references, and multicast features are not supported with Encryption Support. + * Connect attachments, Peering attachments, Network Firewall attachments, VPN Concentrator attachments, Client VPN attachments, security group references, and multicast features are not supported with Encryption Support.