AWS opensearch-service medium security documentation change
Summary
Added requirement that CIDR block must use /24 prefix length when attaching pipeline to VPC
Security assessment
Enforcing /24 subnet size reduces attack surface by preventing overly large CIDR ranges that could expose unnecessary network segments. This mitigates potential lateral movement risks.
Diff
diff --git a/opensearch-service/latest/developerguide/aurora-PostgreSQL.md b/opensearch-service/latest/developerguide/aurora-PostgreSQL.md index d96c66dda..9198e6098 100644 --- a//opensearch-service/latest/developerguide/aurora-PostgreSQL.md +++ b//opensearch-service/latest/developerguide/aurora-PostgreSQL.md @@ -329 +329 @@ To use Amazon Aurora as a source, you need to configure VPC access for the pipel -If you're using the AWS Management Console to create your pipeline, you must also attach your pipeline to your VPC in order to use Amazon Aurora as a source. To do this, find the **Network configuration** section, choose **Attach to VPC** , and choose your CIDR from one of the provided default options, or select your own. You can use any CIDR from a private address space as defined in the [RFC 1918 Best Current Practice](https://datatracker.ietf.org/doc/html/rfc1918). +If you're using the AWS Management Console to create your pipeline, you must also attach your pipeline to your VPC in order to use Amazon Aurora as a source. To do this, find the **Network configuration** section, choose **Attach to VPC** , and choose your CIDR from one of the provided default options, or select your own. The CIDR block must use a /24 prefix length. You can use any /24 CIDR from a private address space as defined in the [RFC 1918 Best Current Practice](https://datatracker.ietf.org/doc/html/rfc1918).