AWS vpc documentation change
Summary
Clarified DNS behavior for ARN-type resource configurations in VPC Lattice. Added exception where private hosted zones aren't created when resource gateway is in the same VPC as the service network endpoint.
Security assessment
The change documents DNS management behavior exceptions without indicating any security vulnerability resolution or security feature implementation.
Diff
diff --git a/vpc/latest/privatelink/resource-configuration.md b/vpc/latest/privatelink/resource-configuration.md index 6f8d42325..9f626c706 100644 --- a//vpc/latest/privatelink/resource-configuration.md +++ b//vpc/latest/privatelink/resource-configuration.md @@ -137,0 +138,7 @@ For resource configurations that are domain-name targets, a private hosted zone +For resource configurations that are of type ARN, VPC Lattice does not create a private hosted zone entry if the following are true: + + * Resource gateway is in the same VPC as the service network VPC endpoint/service network VPC association. + + + + @@ -144 +151 @@ If a service network owner creates a service network resource association and do -For resource configurations of type ARN the private DNS flag is true and immutable. +For resource configurations of type ARN, the private DNS flag is true and immutable. Therefore, VPC Lattice provisions private hosted zones for ARN resource types regardless of the private DNS property setting of the service network endpoint and the service network VPC association, except when the resource gateway is also in the same VPC. In other words, when a VPC is both a consumer and a provider for an ARN type of resource configuration, VPC Lattice skips the creation of the private hosted zones in such a VPC.