AWS vpc medium security documentation change
Summary
Added documentation for 'Resource Config DNS Resolution' feature with two resolution modes (PUBLIC and IN_VPC) and their constraints
Security assessment
The change introduces DNS resolution configuration options that impact security posture. The IN_VPC option forces DNS resolution through private resolvers, preventing potential DNS leakage to public internet and enabling secure resolution of private hosted zones. This addresses data exfiltration risks and enhances VPC isolation.
Diff
diff --git a/vpc/latest/privatelink/resource-gateway.md b/vpc/latest/privatelink/resource-gateway.md index 8dfd56455..30f739472 100644 --- a//vpc/latest/privatelink/resource-gateway.md +++ b//vpc/latest/privatelink/resource-gateway.md @@ -7 +7 @@ -ConsiderationsSecurity groupsIP address typesIPv4 addresses per ENI +ConsiderationsSecurity groupsIP address typesIPv4 addresses per ENIResource Config DNS Resolution @@ -26,0 +27,2 @@ A resource gateway does not provide load balancing capabilities. + * Resource Config DNS Resolution + @@ -83,0 +86,13 @@ If your resource gateway uses the IPv6 address type, the resource gateway automa +## Resource Config DNS Resolution + +You can specify how a resource gateway does DNS resolution for resource configurations that are domain-name targets. This property is immutable. You can choose: + + * **PUBLIC (default)** \- Domain names are resolved using public DNS resolvers. + + * **IN_VPC** \- Domain names are resolved using the DNS server configured in the DHCP option set of the VPC which the resource gateway is in. You should use this if you are using a private DNS server or your domain-name targets are in a Route53 private hosted zone. + + + + +If DNS resolution is IN_VPC, you cannot attach resource configurations defined by ARN to the resource gateway. You cannot set DNS Resolution to IN_VPC if the resource gateway uses IPv6-only subnets. +