AWS vpc-lattice documentation change
Summary
Added 'Resource Config DNS Resolution' section explaining PUBLIC/IN_VPC options and constraints
Security assessment
Documents security-focused IN_VPC DNS resolution feature that keeps DNS queries within VPC boundaries, preventing data leakage to public resolvers. No evidence of patching a security flaw.
Diff
diff --git a/vpc-lattice/latest/ug/resource-gateway.md b/vpc-lattice/latest/ug/resource-gateway.md index 2ae3ca19b..4552d41f0 100644 --- a//vpc-lattice/latest/ug/resource-gateway.md +++ b//vpc-lattice/latest/ug/resource-gateway.md @@ -7 +7 @@ -ConsiderationsSecurity groupsIP address typesIPv4 addresses per ENI +ConsiderationsSecurity groupsIP address typesIPv4 addresses per ENIResource Config DNS Resolution @@ -28,0 +29,2 @@ The following diagram shows how a client accesses a resource through the resourc + * Resource Config DNS Resolution + @@ -91,0 +94,13 @@ If your resource gateway uses the IPv6 address type, the resource gateway automa +## Resource Config DNS Resolution + +You can specify how a resource gateway does DNS resolution for resource configurations that are domain-name targets. This property is immutable. You can choose: + + * **PUBLIC (default)** \- Domain names are resolved using public DNS resolvers. + + * **IN_VPC** \- Domain names are resolved using the DNS server configured in the DHCP option set of the VPC which the resource gateway is in. You should use this if you are using a private DNS server or your domain-name targets are in a Route53 private hosted zone. + + + + +If DNS resolution is IN_VPC, you cannot attach resource configurations defined by ARN to the resource gateway. You cannot set DNS Resolution to IN_VPC if the resource gateway uses IPv6-only subnets. +