AWS vpc documentation change
Summary
Added documentation for 12 new VPC Flow Log fields including instance tags, interface tags, ASG tags, interface types, and next-hop metadata with requirements for permissions and CloudTrail integration
Security assessment
The change enhances documentation for VPC Flow Logs (a security monitoring feature) by adding new metadata fields like resource tags and network path details. While this improves security observability, there's no evidence it addresses a specific vulnerability. The added permissions requirements (ec2:DescribeTags, iam:CreateServiceLinkedRole) and CloudTrail dependency improve security documentation by clarifying access controls for tag-based monitoring.
Diff
diff --git a/vpc/latest/userguide/flow-log-records.md b/vpc/latest/userguide/flow-log-records.md index e4e7efa02..37fdca242 100644 --- a//vpc/latest/userguide/flow-log-records.md +++ b//vpc/latest/userguide/flow-log-records.md @@ -145,0 +146,12 @@ The value is '-' if VPC Encryption Controls is not enabled, or if FlowLog cannot +instance-tag | Tag value for the first instance tag included in your TagFieldSpecifications. Tag values are displayed translating all special characters with UTF-8 percent encoding. To include this field in your subscription, you need permission to call ec2:DescribeTags and iam:CreateServiceLinkedRole. For information about the Flow Logs Amazon EC2 Tags Service Linked Role, see [Using service-linked roles for VPC Flow Logs](./flow-logs-slr.html). **Parquet data type:** STRING | 11 +instance-tag-2 | Tag value for the second instance tag included in your TagFieldSpecifications. Tag values are displayed translating all special characters with UTF-8 percent encoding. To include this field in your subscription, you need permission to call ec2:DescribeTags and iam:CreateServiceLinkedRole. For information about the Flow Logs Amazon EC2 Tags Service Linked Role, see [Using service-linked roles for VPC Flow Logs](./flow-logs-slr.html). **Parquet data type:** STRING | 11 +interface-tag | Tag value for the first network-interface tag included in your TagFieldSpecifications. Tag values are displayed translating all special characters with UTF-8 percent encoding. To include this field in your subscription, you need permission to call ec2:DescribeTags and iam:CreateServiceLinkedRole. For information about the Flow Logs Amazon EC2 Tags Service Linked Role, see [Using service-linked roles for VPC Flow Logs](./flow-logs-slr.html). **Parquet data type:** STRING | 11 +interface-tag-2 | Tag value for the second network-interface tag included in your TagFieldSpecifications. Tag values are displayed translating all special characters with UTF-8 percent encoding. To include this field in your subscription, you need permission to call ec2:DescribeTags and iam:CreateServiceLinkedRole. For information about the Flow Logs Amazon EC2 Tags Service Linked Role, see [Using service-linked roles for VPC Flow Logs](./flow-logs-slr.html). **Parquet data type:** STRING | 11 +asg-tag | Tag value for the first auto-scaling-group tag included in your TagFieldSpecifications. Tag values are displayed translating all special characters with UTF-8 percent encoding. To include this field in your subscription, you need permission to call autoscaling:DescribeTags and iam:CreateServiceLinkedRole. You must have at least one enabled CloudTrail trail in your account for Auto Scaling group tag values to be properly tracked and updated in real time. For information about the Flow Logs Amazon EC2 Tags Service Linked Role, see [Using service-linked roles for VPC Flow Logs](./flow-logs-slr.html). **Parquet data type:** STRING | 11 +asg-tag-2 | Tag value for the second auto-scaling-group tag included in your TagFieldSpecifications. Tag values are displayed translating all special characters with UTF-8 percent encoding. To include this field in your subscription, you need permission to call autoscaling:DescribeTags and iam:CreateServiceLinkedRole. You must have at least one enabled CloudTrail trail in your account for Auto Scaling group tag values to be properly tracked and updated in real time. For information about the Flow Logs Amazon EC2 Tags Service Linked Role, see [Using service-linked roles for VPC Flow Logs](./flow-logs-slr.html). **Parquet data type:** STRING | 11 +interface-type | The type of the local network interface which captures the flow. The supported values are: `nat_gateway` | `network_load_balancer` | `regional_nat_gateway` | `transit_gateway` | `vpc_endpoint`. If the network interface doesn’t have an associate service, or the service is not supported, the value is '-'. **Parquet data type:** STRING | 11 +next-hop-interface-id | The ID of the next hop network interface. For egress traffic, this is the interface that receives the traffic. For ingress traffic, this is the interface that sends the traffic. **Parquet data type:** STRING | 11 +next-hop-subnet-id | The ID of the subnet that contains the next hop network interface. **Parquet data type:** STRING | 11 +next-hop-az-id | The ID of the Availability Zone that contains the next hop network interface. **Parquet data type:** STRING | 11 +next-hop-vpc-id | The ID of the VPC that contains the next hop network interface. **Parquet data type:** STRING | 11 +next-hop-interface-type | The type of the next hop network interface. For a list of possible values, see the interface-type field **Parquet data type:** STRING | 11