AWS awsconsolehelpdocs documentation change
Summary
Updated title, added console-static endpoint requirement, removed us-east-1 connectivity guidance, and added notes about unsupported endpoints and network isolation requirements.
Security assessment
Changes document new security requirements (console-static endpoint) for fully isolated environments and clarify limitations. No evidence of patching a vulnerability; instead, they provide proactive guidance for secure network configurations.
Diff
diff --git a/awsconsolehelpdocs/latest/gsg/required-endpoints-dns-configuration.md b/awsconsolehelpdocs/latest/gsg/required-endpoints-dns-configuration.md index ee0b9a1da..f73eb0da7 100644 --- a//awsconsolehelpdocs/latest/gsg/required-endpoints-dns-configuration.md +++ b//awsconsolehelpdocs/latest/gsg/required-endpoints-dns-configuration.md @@ -7 +7 @@ -# Required VPC endpoints and DNS configuration +# Configuring VPC endpoints for accessing AWS Management Console @@ -9 +9 @@ -AWS Management Console Private Access requires the following two VPC endpoints per Region. Replace `region` with your own Region information. +AWS Management Console Private Access supports operating in networks without access to the public internet. When you configure VPC endpoints for AWS Sign-In, AWS Management Console, and console static content, all browser traffic is routed through AWS PrivateLink. Internet connectivity is not required for the AWS Management Console itself. @@ -11 +11 @@ AWS Management Console Private Access requires the following two VPC endpoints p - 1. com.amazonaws.`region`.console for AWS Management Console +AWS Management Console Private Access requires the following VPC endpoints per Region. Replace `region` with your own Region information. @@ -13 +13 @@ AWS Management Console Private Access requires the following two VPC endpoints p - 2. com.amazonaws.`region`.signin for AWS Sign-In + 1. com.amazonaws.`region`.console – for AWS Management Console @@ -14,0 +15 @@ AWS Management Console Private Access requires the following two VPC endpoints p + 2. com.amazonaws.`region`.signin – for AWS Sign-In @@ -15,0 +17 @@ AWS Management Console Private Access requires the following two VPC endpoints p + 3. com.amazonaws.`region`.console-static – for static content and other console-specific APIs (required for network-isolated environments) @@ -18,3 +19,0 @@ AWS Management Console Private Access requires the following two VPC endpoints p -###### Note - -Always provision infrastructure and networking connectivity to the US East (N. Virginia) (us-east-1) Region, regardless of other Regions you use with the AWS Management Console. You can use AWS Transit Gateway to set up connectivity between the US East (N. Virginia) and every other Region. For more information, see [Getting started with transit gateways](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-getting-started.html) in the _Amazon VPC Transit Gateways guide_. You can also use Amazon VPC peering. For more information, see [What is VPC peering](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) in the _Amazon VPC Peering Guide_. To compare these options, see [Amazon VPC-to-Amazon VPC connectivity options ](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/amazon-vpc-to-amazon-vpc-connectivity-options.html) in the _Amazon Virtual Private Cloud Connectivity Options whitepaper_. @@ -22 +20,0 @@ Always provision infrastructure and networking connectivity to the US East (N. V -###### Topics @@ -24 +22 @@ Always provision infrastructure and networking connectivity to the US East (N. V - * [DNS configuration for AWS Management Console and AWS Sign-In](./dns-configuration-console-signin.html) +AWS Management Console calls AWS services through a combination of direct browser requests and requests that are proxied by web servers. You should also configure AWS PrivateLink VPC endpoints for all AWS services that you intend to use in your environment. If you access a service console that does not have a configured VPC endpoint, you might see errors for that functionality. This is expected behavior in a network-isolated environment. @@ -26 +24 @@ Always provision infrastructure and networking connectivity to the US East (N. V - * [VPC endpoints and DNS configuration for AWS services in the AWS Management Console](./vpc-dns-configuration-aws-services.html) +###### Note @@ -27,0 +26 @@ Always provision infrastructure and networking connectivity to the US East (N. V +Currently, AWS Management Console Private Access doesn't support endpoints such as `status.aws.amazon.com`, `health.aws.amazon.com`, and `docs.aws.amazon.com`. You will need to route these domains to the public internet, or accept that these features will be unavailable in a fully isolated environment. @@ -28,0 +28 @@ Always provision infrastructure and networking connectivity to the US East (N. V +###### Note @@ -29,0 +30 @@ Always provision infrastructure and networking connectivity to the US East (N. V +The console-static VPC endpoint is required when you want to use the AWS Management Console in a network without access to the public internet. This endpoint handles static content (JavaScript, CSS, images) and console-specific APIs that were previously served over the public internet. If your network has internet connectivity, this endpoint is optional but recommended for full traffic control. @@ -37 +38 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Overview of AWS Management Console Private Access security controls +Supported AWS Regions, service consoles, and features @@ -39 +40 @@ Overview of AWS Management Console Private Access security controls -DNS configuration +Configuring DNS