AWS rtb-fabric documentation change
Summary
Added new sections for updating, getting, and listing responder gateways; reorganized CLI examples; added domain allowlisting requirement and role tagging for HTTPS; added listener configuration details; clarified deletion prerequisites
Security assessment
The change adds security documentation by requiring domain allowlisting and role tagging ('RTBFabricManagedEndpoint=true') for HTTPS managed endpoints, and clarifies HTTP bypasses TLS termination. However, there's no evidence this addresses a specific vulnerability.
Diff
diff --git a/rtb-fabric/latest/userguide/working-with-responder-gateways.md b/rtb-fabric/latest/userguide/working-with-responder-gateways.md index 4fda14d52..df472103d 100644 --- a//rtb-fabric/latest/userguide/working-with-responder-gateways.md +++ b//rtb-fabric/latest/userguide/working-with-responder-gateways.md @@ -7 +7 @@ -Creating a responder gatewayCreating an external responder gatewaySearching for responder gatewaysViewing associated linksDeleting responder gateways +Creating a responder gatewayCreating an external responder gatewaySearching for responder gatewaysUpdating an existing responder gatewayGetting a responder gatewayListing responder gatewaysViewing associated linksDeleting responder gateways @@ -20,0 +21,6 @@ Responder gateways are RTB Fabric infrastructure components that serve as connec + * Updating an existing responder gateway + + * Getting a responder gateway + + * Listing responder gateways + @@ -113,23 +118,0 @@ After creating your gateway, you can view its details, monitor performance metri -### Updating gateway description - -You can update the gateway description using the RTB Fabric API. For more information, see the [AWS RTB Fabric API Reference](https://docs.aws.amazon.com//rtb-fabric/latest/api/). - -### Listener configuration - -A listener configuration defines which protocols a gateway with external links accepts for incoming traffic. By default, a gateway listens on a single protocol (HTTPS). With multiprotocol support, you can configure a gateway to accept both HTTP and HTTPS traffic simultaneously using the `listenerConfig` parameter. - -The `listenerConfig` contains a `protocols` list that specifies one or two protocols: - - * `["HTTPS"]` — The gateway accepts HTTPS traffic only (default). - - * `["HTTP", "HTTPS"]` — The gateway accepts both HTTP and HTTPS traffic. - - - - -Multi-protocol support is useful when you need to support partners that send traffic over HTTP while also serving HTTPS traffic with TLS termination. When both protocols are enabled, the gateway provisions listeners for each protocol on the public ingress cluster. - -###### Note - -If you enable both HTTP and HTTPS, TLS certificate association and SNI-based certificate resolution apply only to HTTPS connections. HTTP connections bypass TLS termination entirely. - @@ -138,15 +121 @@ Use the following command to create a responder gateway using the AWS Command Li -**Create a responder gateway with required parameters** - - - $ aws rtbfabric create-responder-gateway \ - --description "My RTB responder gateway" \ - --vpc-id vpc-01f345ad6524a6d7 \ - --subnet-ids subnet-abc12345 subnet-def67890 \ - --security-group-ids sg-12345678 \ - --port 443 \ - --protocol HTTPS \ - --client-token "unique-client-token-123" \ - --endpoint-url https://rtbfabric.us-east-1.amazonaws.com \ - --region us-east-1 - -**Create with optional domain name and trust store configuration** +**Create a responder gateway with domain name and trust store configuration** @@ -163 +131,0 @@ Use the following command to create a responder gateway using the AWS Command Li - --client-token "unique-client-token-123" \ @@ -169 +137 @@ Use the following command to create a responder gateway using the AWS Command Li -**Create with multi-protocol listener configuration (HTTP and HTTPS)** +**Create with EKS managed endpoint configuration** @@ -173,4 +141,4 @@ Use the following command to create a responder gateway using the AWS Command Li - --description "My RTB responder gateway" \ - --vpc-id vpc-01f345ad6524a6d7 \ - --subnet-ids subnet-abc12345 subnet-def67890 \ - --security-group-ids sg-12345678 \ + --description "My EKS responder gateway" \ + --vpc-id vpc-0abc1234def567890 \ + --subnet-ids subnet-0abc1234def567890 subnet-0def5678abc901234 \ + --security-group-ids sg-0abc1234def567890 \ @@ -179,4 +147,2 @@ Use the following command to create a responder gateway using the AWS Command Li - --listener-config '{"protocols":["HTTP","HTTPS"]}' \ - --client-token "unique-client-token-123" \ - --gateway-type EXTERNAL \ - --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/MyASGRole"}}' \ + --domain-name bidder.example.com \ + --managed-endpoint-configuration '{"eksEndpoints":{"endpointsResourceName":"my-bidder-service","endpointsResourceNamespace":"bidding-ns","clusterApiServerEndpointUri":"https://ABCDEF1234567890.gr7.us-east-1.eks.amazonaws.com","clusterApiServerCaCertificateChain":"LS0tLS1CRUdJTi...base64-encoded-CA-cert...LS0tLS1FTkQ=","clusterName":"my-eks-cluster","roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \ @@ -186 +152 @@ Use the following command to create a responder gateway using the AWS Command Li -**Create with EKS managed endpoint configuration** +**Create with ASG managed endpoint configuration** @@ -190 +156 @@ Use the following command to create a responder gateway using the AWS Command Li - --description "My EKS responder gateway" \ + --description "My ASG responder gateway" \ @@ -194,5 +160,3 @@ Use the following command to create a responder gateway using the AWS Command Li - --port 443 \ - --protocol HTTPS \ - --gateway-type EXTERNAL \ - --managed-endpoint-configuration '{"eksEndpoints":{"endpointsResourceName":"my-bidder-service","endpointsResourceNamespace":"bidding-ns","clusterApiServerEndpointUri":"https://ABCDEF1234567890.gr7.us-east-1.eks.amazonaws.com","clusterApiServerCaCertificateChain":"LS0tLS1CRUdJTi...base64-encoded-CA-cert...LS0tLS1FTkQ=","clusterName":"my-eks-cluster","roleArn":"arn:aws:iam::123456789012:role/MyEksEndpointDiscoveryRole"}}' \ - --client-token "550e8400-e29b-41d4-a716-446655440000" \ + --port 8080 \ + --protocol HTTP \ + --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \ @@ -209,0 +174,28 @@ Create an external responder gateway in RTB Fabric if you do not already have on +###### To create an external responder gateway + + 1. Follow the same steps as Creating a responder gateway, but on the creation page, select the **External gateway** tile instead of the default gateway type. + + 2. Complete the remaining configuration fields as described in the standard gateway creation procedure. + + + + +### Listener configuration + +A listener configuration defines which protocols a gateway with external links accepts for incoming traffic. By default, a gateway listens on a single protocol (HTTPS). With multiprotocol support, you can configure a gateway to accept both HTTP and HTTPS traffic simultaneously using the `listenerConfig` parameter. + +The `listenerConfig` contains a `protocols` list that specifies one or two protocols: + + * `["HTTPS"]` — The gateway accepts HTTPS traffic only (default). + + * `["HTTP", "HTTPS"]` — The gateway accepts both HTTP and HTTPS traffic. + + + + +Multi-protocol support is useful when you need to support partners that send traffic over HTTP while also serving HTTPS traffic with TLS termination. When both protocols are enabled, the gateway provisions listeners for each protocol on the public ingress cluster. + +###### Note + +If you enable both HTTP and HTTPS, TLS certificate association and SNI-based certificate resolution apply only to HTTPS connections. HTTP connections bypass TLS termination entirely. + @@ -212 +204 @@ Use the following command to create an external responder gateway using the AWS -**Create an external responder gateway with HTTP** +**Create an external responder gateway with HTTP and ASG managed endpoint** @@ -222 +214 @@ Use the following command to create an external responder gateway using the AWS - --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/MyASGRole"}}' \ + --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \ @@ -227 +219 @@ Use the following command to create an external responder gateway using the AWS -**Create an external responder gateway with HTTPS** +**Create an external responder gateway with multi-protocol listener configuration (HTTP and HTTPS)** @@ -237 +229,3 @@ Use the following command to create an external responder gateway using the AWS - --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/MyASGRole"}}' \ + --listener-config '{"protocols":["HTTP","HTTPS"]}' \ + --domain-name bidder.example.com \ + --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \ @@ -242 +236 @@ Use the following command to create an external responder gateway using the AWS -**Create an external responder gateway with EKS managed endpoints** +**Create an external responder gateway with HTTPS and EKS managed endpoint** @@ -252 +246,2 @@ Use the following command to create an external responder gateway using the AWS - --managed-endpoint-configuration '{"eksEndpoints":{"endpointsResourceName":"my-bidder-service","endpointsResourceNamespace":"bidding-ns","clusterApiServerEndpointUri":"https://ABCDEF1234567890.gr7.us-east-1.eks.amazonaws.com","clusterApiServerCaCertificateChain":"LS0tLS1CRUdJTi...base64-encoded-CA-cert...LS0tLS1FTkQ=","clusterName":"my-eks-cluster","roleArn":"arn:aws:iam::123456789012:role/MyEksEndpointDiscoveryRole"}}' \ + --domain-name bidder.example.com \ + --managed-endpoint-configuration '{"eksEndpoints":{"endpointsResourceName":"my-bidder-service","endpointsResourceNamespace":"bidding-ns","clusterApiServerEndpointUri":"https://ABCDEF1234567890.gr7.us-east-1.eks.amazonaws.com","clusterApiServerCaCertificateChain":"LS0tLS1CRUdJTi...base64-encoded-CA-cert...LS0tLS1FTkQ=","clusterName":"my-eks-cluster","roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \ @@ -261 +256,5 @@ Use the following command to create an external responder gateway using the AWS - * `--managed-endpoint-configuration` — Required for external gateways. Specifies the backend that receives traffic. Provide either an `autoScalingGroups` configuration (with ASG names and a role ARN) or an `eksEndpoints` configuration (with EKS cluster details). + * `--managed-endpoint-configuration` — Required for external gateways. Specifies the backend that receives traffic. Provide either an `autoScalingGroups` configuration (with ASG names and a role ARN) or an `eksEndpoints` configuration (with EKS cluster details). For more information, see [Managed endpoints](./managed-endpoints.html). + +###### Important + +When using `--protocol HTTPS` with `--managed-endpoint-configuration`, the `--domain-name` parameter is required. The domain name must be allowlisted by the RTB Fabric team for your account before you can create your gateway. Contact AWS Support to request domain name allowlisting. The role used for managed endpoint must have **RTBFabricManagedEndpoint=true** tag. @@ -290,0 +290,47 @@ Use the search functionality in the console to locate specific gateways in your +## Updating an existing responder gateway + +You can update the gateway description and Auto Scaling group managed endpoint configuration. Other fields cannot be updated after gateway creation. + +###### To update a responder gateway + + 1. On the **Responder gateways** page, select the radio button next to the responder gateway you want to update. + + 2. Choose **View details**. + + 3. Choose **Edit** to modify the gateway configuration. + +###### Note + +The **Edit** button is only available for responder gateways that have Auto Scaling group managed endpoints configured. + + 4. Update the **Gateway description** or **Auto Scaling group** managed endpoint configuration as needed. + + 5. Choose **Save changes**. + + + + +Use the following commands to update a responder gateway using the AWS Command Line Interface (AWS CLI). + +**Update gateway description** + + + $ aws rtbfabric update-responder-gateway \ + --gateway-id "rtb-gw-kasoi29asfdhn" \ + --description "Updated responder gateway description" \ + --endpoint-url https://rtbfabric.us-east-1.amazonaws.com \ + --region us-east-1 + +**Update Auto Scaling group managed endpoint configuration** + + + $ aws rtbfabric update-responder-gateway \ + --gateway-id "rtb-gw-kasoi29asfdhn" \ + --managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-new-asg-name","my-second-asg"],"roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \ + --endpoint-url https://rtbfabric.us-east-1.amazonaws.com \ + --region us-east-1 + +## Getting a responder gateway + +Retrieve detailed information about a specific responder gateway, including its configuration, status, VPC settings, and endpoint configuration. + @@ -300,0 +347,13 @@ Use the following command to get details for a specific responder gateway using +## Listing responder gateways + +List all responder gateways in your account.