AWS awsconsolehelpdocs documentation change
Summary
Complete restructuring of DNS configuration documentation for AWS Management Console Private Access. Replaced manual DNS record instructions with automated VPC endpoint DNS resolution guidance. Added network scenario-based sections (single region without internet, corporate-connected, multi-region) with specific configuration requirements and limitations.
Security assessment
This change enhances documentation about securing AWS console access through VPC endpoints and private DNS, which is a security feature. However, there's no evidence of addressing a specific vulnerability. The update clarifies security implications like cross-region call failures and dependency requirements.
Diff
diff --git a/awsconsolehelpdocs/latest/gsg/dns-configuration-console-signin.md b/awsconsolehelpdocs/latest/gsg/dns-configuration-console-signin.md index 0911c4a83..276aba6ce 100644 --- a//awsconsolehelpdocs/latest/gsg/dns-configuration-console-signin.md +++ b//awsconsolehelpdocs/latest/gsg/dns-configuration-console-signin.md @@ -7 +7 @@ -# DNS configuration for AWS Management Console and AWS Sign-In +Single Region without internet accessSingle Region connected to a corporate networkMultiple Regions connected to a corporate network @@ -9 +9 @@ -To route your network traffic to respective VPC endpoints, configure DNS records in the network from which your users will be accessing the AWS Management Console. These DNS records will direct your users browser traffic toward the VPC endpoints you created. +# Configuring DNS for accessing AWS Management Console @@ -11 +11 @@ To route your network traffic to respective VPC endpoints, configure DNS records -You can create a single hosted zone. However, endpoints such as `health.aws.amazon.com` and `docs.aws.amazon.com` won't be accessible because they don't have VPC endpoints. You will need to route these domains to the public internet. We recommend that you create two private hosted zones per Region, one for `signin.aws.amazon.com` and one for `console.aws.amazon.com` with the following CNAME records: +AWS Management Console Private Access uses VPC endpoints to route browser traffic to the AWS Management Console. When you create VPC endpoints with private DNS enabled, AWS automatically resolves the AWS Management Console and AWS Sign-In domain names to the private IP addresses of your VPC endpoints. In most cases, you do not need to manually configure DNS records. @@ -13 +13 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * Sign-In +The DNS configuration depends on your network setup. The following sections describe the configuration for common scenarios. @@ -15 +15 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * `region`.signin.aws.amazon.com pointing to the AWS Sign-In VPC endpoint in the signin DNS zone where `region` is the desired Region +## Single Region without internet access @@ -17 +17 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * signin.aws.amazon.com pointing to AWS Sign-In VPC endpoint in US East (N. Virginia) (us-east-1) +If you use a dedicated environment such as an Amazon EC2 instance or Amazon WorkSpaces inside a VPC without internet access, DNS resolution is handled automatically by the default VPC DNS resolver. When you create VPC endpoints for AWS Sign-In, AWS Management Console, and console static content with private DNS enabled, the VPC resolver directs traffic to the correct endpoints without additional configuration. @@ -19 +19 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * Console +In this scenario, the following limitations apply: @@ -21 +21 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * `region`.console.aws.amazon.com pointing to the AWS Management Console VPC endpoint in the console DNS zone where `region` is the desired Region + * The AWS Management Console relies on some dependencies that are hosted only in US East (N. Virginia). If you configure a different Region, some features such as might not be available. @@ -23 +23 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * *.`region`.console.aws.amazon.com pointing to the AWS Management Console VPC endpoint in the console DNS zone where `region` is the desired Region + * If you do not configure VPC endpoints for all AWS services that you use, requests to services without endpoints will fail. @@ -25 +25 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * *.`region`.console.aws.amazon.com pointing to the AWS Management Console VPC endpoint in the console DNS zone + * Some service consoles make cross-Region calls. These calls will fail if you have not configured VPC peering and VPC endpoints in the target Region. @@ -27 +26,0 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * Regionless CNAME records for the US East (N. Virginia) Region only. You always have to set up the US East (N. Virginia) Region. @@ -29 +27,0 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * signin.aws.amazon.com pointing to AWS Sign-In VPC endpoint in US East (N. Virginia) (us-east-1) @@ -31 +28,0 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz - * *.console.aws.amazon.com pointing to AWS Management Console VPC endpoint in US East (N. Virginia) (us-east-1) @@ -33 +30 @@ You can create a single hosted zone. However, endpoints such as `health.aws.amaz -For instructions on creating a CNAME record, see [Working with records](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/rrsets-working-with.html) in the _Amazon Route 53 Developer Guide_. +## Single Region connected to a corporate network @@ -35 +32 @@ For instructions on creating a CNAME record, see [Working with records](https:// -Some AWS consoles, including Amazon S3, use different patterns for their DNS names. The following are two examples: +If you connect your VPC to a corporate network using Direct Connect or AWS Site-to-Site VPN, configure split-horizon DNS on your corporate DNS servers to direct AWS Management Console traffic to the VPC endpoints. Point the following domain suffixes to the corresponding VPC endpoints: @@ -37 +34 @@ Some AWS consoles, including Amazon S3, use different patterns for their DNS nam - * support.console.aws.amazon.com + * `.console.aws.amazon.com` – for the AWS Management Console @@ -39 +36 @@ Some AWS consoles, including Amazon S3, use different patterns for their DNS nam - * s3.console.aws.amazon.com + * `.signin.aws.amazon.com` – for AWS Sign-In @@ -41 +38 @@ Some AWS consoles, including Amazon S3, use different patterns for their DNS nam -To be able to direct this traffic to your AWS Management Console VPC endpoint, you need to add those names individually. We recommend that you configure routing for all endpoints for a fully private experience. However, this isn't required to use AWS Management Console Private Access. + * `.amazonaws.com` / `.api.aws` – for AWS service APIs @@ -43 +40 @@ To be able to direct this traffic to your AWS Management Console VPC endpoint, y -The following `json` files contain the full list of AWS services and console endpoints to configure per Region. Use the `PrivateIpv4DnsNames` field under the `com.amazonaws.`region`.console` endpoint for the DNS names. + * `.console.api.aws` and `.console.awsstatic.com` – for AWS Management Console static content and internal APIs @@ -45 +41,0 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/us-east-1.config.json](https://configuration.private-access.console.amazonaws.com/us-east-1.config.json) @@ -47 +42,0 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/us-east-2.config.json](https://configuration.private-access.console.amazonaws.com/us-east-2.config.json) @@ -49 +43,0 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/us-west-2.config.json](https://configuration.private-access.console.amazonaws.com/us-west-2.config.json) @@ -51 +45 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/ap-northeast-1.config.json](https://configuration.private-access.console.amazonaws.com/ap-northeast-1.config.json) +## Multiple Regions connected to a corporate network @@ -53 +47 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/ap-northeast-2.config.json](https://configuration.private-access.console.amazonaws.com/ap-northeast-2.config.json) +If you use more than one Region, for example, if you use one Region for your infrastructure and need to access IAM or Route 53 in US East (N. Virginia), configure your corporate DNS to point regional prefixes to the corresponding VPC endpoints in each Region: @@ -55 +49 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/ap-southeast-1.config.json](https://configuration.private-access.console.amazonaws.com/ap-southeast-1.config.json) + * `.`region`.console.aws.amazon.com` – for the AWS Management Console in each Region @@ -57 +51 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/ap-southeast-2.config.json](https://configuration.private-access.console.amazonaws.com/ap-southeast-2.config.json) + * `.`region`.signin.aws.amazon.com` – for AWS Sign-In in each Region @@ -59 +53 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/ap-south-1.config.json](https://configuration.private-access.console.amazonaws.com/ap-south-1.config.json) + * `.`region`.amazonaws.com` / `.`region`.api.aws` – for AWS service APIs in each Region @@ -61 +54,0 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/ap-south-2.config.json](https://configuration.private-access.console.amazonaws.com/ap-south-2.config.json) @@ -63 +55,0 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/ca-central-1.config.json](https://configuration.private-access.console.amazonaws.com/ca-central-1.config.json) @@ -65 +56,0 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/eu-central-1.config.json]( https://configuration.private-access.console.amazonaws.com/eu-central-1.config.json) @@ -67 +58 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/eu-west-1.config.json](https://configuration.private-access.console.amazonaws.com/eu-west-1.config.json) +In addition, point the following region-agnostic domains to VPC endpoints in one or two specific Regions. Any supported Region can handle these domains: @@ -69 +60 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/eu-west-2.config.json](https://configuration.private-access.console.amazonaws.com/eu-west-2.config.json) + * `.global.console.aws.amazon.com` @@ -71 +62 @@ The following `json` files contain the full list of AWS services and console end - * [https://configuration.private-access.console.amazonaws.com/il-central-1.config.json](https://configuration.private-access.console.amazonaws.com/il-central-1.config.json) + * `.console.api.aws` @@ -73,9 +64 @@ The following `json` files contain the full list of AWS services and console end -###### Note - -This list is updated each month as we add additional endpoints to the scope of AWS Management Console Private Access. To keep your private hosted zones updated, periodically pull the preceding list of files. - -If you use Route 53 to configure your DNS, go to https://console.aws.amazon.com/route53/v2/hostedzones# to verify the DNS setup. For each Private Hosted Zone in Route 53, verify that the following record sets are present. - - * console.aws.amazon.com - - * signin.aws.amazon.com + * `.console.awsstatic.com` @@ -83 +65,0 @@ If you use Route 53 to configure your DNS, go to https://console.aws.amazon.com/ - * *.`region`.console.aws.amazon.com @@ -85 +66,0 @@ If you use Route 53 to configure your DNS, go to https://console.aws.amazon.com/ - * `region`.console.aws.amazon.com @@ -87 +67,0 @@ If you use Route 53 to configure your DNS, go to https://console.aws.amazon.com/ - * *.`region`.console.aws.amazon.com @@ -89,5 +69 @@ If you use Route 53 to configure your DNS, go to https://console.aws.amazon.com/ - * signin.aws.amazon.com - - * `region`.signin.aws.amazon.com - - * Additional records present in the previously listed JSON files +###### Note @@ -94,0 +71 @@ If you use Route 53 to configure your DNS, go to https://console.aws.amazon.com/ +Some service consoles, such as IAM, Cloudfront, and Route 53, are hosted only in US East (N. Virginia). To access these consoles, you must set up AWS Management Console Private Access in US East (N. Virginia) and use VPC peering or AWS Transit Gateway to connect it to your other Regions. @@ -95,0 +73 @@ If you use Route 53 to configure your DNS, go to https://console.aws.amazon.com/ +###### Note @@ -96,0 +75 @@ If you use Route 53 to configure your DNS, go to https://console.aws.amazon.com/ +DynamoDB VPC endpoints require manual creation of a private hosted zone. See [AWS PrivateLink for DynamoDB](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/privatelink-interface-endpoints.html) for instructions. @@ -104 +83 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Required VPC endpoints and DNS configuration +Configuring VPC endpoints @@ -106 +85 @@ Required VPC endpoints and DNS configuration -VPC endpoints and DNS configuration for AWS services +Implementing access controls