AWS vpc-lattice documentation change
Summary
Updated documentation about private DNS behavior for ARN-type resources in VPC Lattice, specifying conditions where private hosted zones aren't created.
Security assessment
This clarifies operational behavior of DNS provisioning but contains no evidence of addressing security vulnerabilities or introducing security features.
Diff
diff --git a/vpc-lattice/latest/ug/resource-configuration.md b/vpc-lattice/latest/ug/resource-configuration.md index 67225b400..36e9c9fc6 100644 --- a//vpc-lattice/latest/ug/resource-configuration.md +++ b//vpc-lattice/latest/ug/resource-configuration.md @@ -147,0 +148,7 @@ For resource configurations that are domain-name targets, a private hosted zone +For resource configurations of type ARN, VPC Lattice does not create a private hosted zone entry if the following is true: + + * The resource gateway is in the same VPC as the service network VPC endpoint or service network VPC association. + + + + @@ -154 +161 @@ If a service network owner creates a service network resource association and do -For resource configurations of type ARN the private DNS flag is true and immutable. +For resource configurations of type ARN, the private DNS flag is true and immutable. VPC Lattice provisions private hosted zones for ARN resource types regardless of the private DNS property setting of the service network endpoint and the service network VPC association. The exception is when the resource gateway is in the same VPC. In other words, when a VPC is both a consumer and a provider for an ARN type of resource configuration, VPC Lattice skips the creation of the private hosted zones in that VPC.