AWS vpc medium security documentation change
Summary
Added limitations for EC2 Tags fields in Flow Logs v11 and next-hop fields, including security restrictions on cross-account tag visibility and requirements for CloudTrail trails.
Security assessment
Explicitly states tags from other accounts are excluded due to security concerns (cross-account data leakage prevention) and mandates CloudTrail for accurate ASG tags (audit trail requirement).
Diff
diff --git a/vpc/latest/userguide/flow-logs-limitations.md b/vpc/latest/userguide/flow-logs-limitations.md index c76595316..6e2fda57e 100644 --- a//vpc/latest/userguide/flow-logs-limitations.md +++ b//vpc/latest/userguide/flow-logs-limitations.md @@ -98,0 +99,36 @@ Limitations specific to `encryption-status` field: +Limitations specific to Flow Logs Amazon EC2 Tags fields available in version 11: + + * Tag fields are not computed if the tags on a resource are not owned by the owner of the flow log subscription. For example, if you share a subnet (`SubnetA`) with another account (`AccountB`), and then you create a flow log subscription for `SubnetA` with a tag field on network-interfaces, if `AccountB` launches a tagged network-interface with the key you configured, your subscription will receive traffic logs for the network-interface launched by `AccountB` but the tag fields configured by your subscription will not be computed due to security concerns. You can choose to tag that network-interface launched by `AccountB` to display tags if desired. + + * If you create flow log subscriptions with Tag fields at the VPC/Subnet resource level, any traffic generated for non-tagged network interfaces will also be delivered for your subscriptions. The values for Tag fields will be '-' for non-tagged resources. + + * Auto Scaling groups will not be able to display any tags if they are named '-' since this is a reserved character to indicate missing/no value. + + * Creation of any Flow Logs subscription with Tags fields will result in the creation of a few resources on the customer's behalf. To consume updates to your tag values, EventBridge Managed Rules will be created to send tag changes to the Flow Logs service. These EventBridge Managed Rules will be automatically cleaned up if all subscriptions with Tag fields are deleted. Do not manually delete these EventBridge Managed Rules. Doing so will result in large delays updating tag values. To control this creation/cleanup and provide access to tag values, a Service Linked Role will be created in your account. See [Using service-linked roles for VPC Flow Logs](./flow-logs-slr.html) for more details. + + * Due to Amazon CloudWatch Logs parsing and Athena parsing constraints, all special characters in tag values will be encoded using UTF-8 percent encoding. This can be decoded natively in Athena using `url_decode` or can be decoded by any URL or URI decoder. + + * For the first hour after a new subscription is created, tag values may be missing or inaccurate. After this first hour, tag values will be able to accurately reflect the values of your tagged resources with 1 minute granularity. + + * If multiple tag changes are made on the same resource within the same second, there is potential for updates to be lost, resulting in up to one hour of stale tag values. + + * For Auto Scaling group tag fields, you must have at least one enabled CloudTrail trail in your account. Without an enabled trail, Auto Scaling group tag values may be stale or inaccurate. + + + + +Limitations specific to `next-hop-` fields: + + * The next hop fields are not computed if the next hop network interface is not owned by the owner of the flow log subscription, except for `next-hop-az-id`. + + * The next hop fields are not available if the next hop doesn't have a network interface(For example, traffic to internet gateway). + + * The next hop fields are not available for cross-region traffic. + + * The next hop fields are not available for ingress traffic from some network services(for example, transit gateway and Network Load Balancer). + + * If the traffic go through a middle-box(for example transit gateway, Network Load Balancer), the next hop network interface is the network interface associated with the middle box(such as the transit gateway attachment), not the final destination of the traffic + + + +