AWS vpc documentation change
Summary
Added DNS resolution requirements for domain-name targets and private hosted zones
Security assessment
Clarifies DNS configuration requirements for network routing. While misconfiguration could cause security issues, this change documents expected behavior rather than addressing vulnerabilities.
Diff
diff --git a/vpc/latest/privatelink/resource-configuration.md b/vpc/latest/privatelink/resource-configuration.md index e49278572..6f8d42325 100644 --- a//vpc/latest/privatelink/resource-configuration.md +++ b//vpc/latest/privatelink/resource-configuration.md @@ -126,0 +127,11 @@ The following considerations apply to consumers of resource configurations: +For resource configurations that are domain-name targets, a private hosted zone entry is not created if the following are true: + + * Resource gateway is in the same VPC as the service network VPC endpoint/service network VPC association. + + * DNS resolution is set to IN_VPC on the resource gateway. + + * The custom domain name or group domain is the same or higher-level domain of the domain-name target. + + + + @@ -141 +152 @@ In the resource configuration, identify the resource in one of the following way - * By a **domain-name target** : Any domain name that is publicly resolvable. If your domain name points to an IP that's outside of your VPC, you must have a NAT gateway in your VPC. + * By a **domain-name target** : You can use any domain name. If you use a private DNS server or your domain is in a Route53 private hosted zone, then the resource gateway must have DNS resolution set to IN_VPC. If your domain name points to an IP that's outside of your VPC, you must have a NAT gateway in your VPC.