AWS awsconsolehelpdocs high security documentation change
Summary
Simplified the CloudFormation template by removing public subnets, NAT gateway, and Route53 resources; reduced from three to two private subnets; added VPC endpoint policies with explicit account/VPC restrictions; enforced IMDSv2; updated security group rules.
Security assessment
The change enforces IMDSv2 (HttpTokens: required) to mitigate SSRF vulnerabilities, adds explicit VPC endpoint policies restricting access to the same AWS account and VPC, and configures security group rules to limit RDP access to the VPC CIDR. These modifications directly address security weaknesses by reducing attack surface and enforcing least privilege.
Diff
diff --git a/awsconsolehelpdocs/latest/gsg/test-console-private-access-EC2.md b/awsconsolehelpdocs/latest/gsg/test-console-private-access-EC2.md index 75eadc3a9..6a185313c 100644 --- a//awsconsolehelpdocs/latest/gsg/test-console-private-access-EC2.md +++ b//awsconsolehelpdocs/latest/gsg/test-console-private-access-EC2.md @@ -9,3 +9 @@ -[Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/ec2/?icmpid=docs_homepage_compute) (Amazon EC2), provides scalable computing capacity in the Amazon Web Services cloud. You can use Amazon EC2 to launch as many or as few virtual servers as you need, configure security and networking, and manage storage. In this setup, we use [Fleet Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/fleet.html), a capability of AWS Systems Manager, to connect to an Amazon EC2 Windows instance using the Remote Desktop Protocol (RDP). - -This guide demonstrates a test environment to set up and experience an AWS Management Console Private Access connection to Amazon Simple Storage Service from an Amazon EC2 instance. This tutorial uses CloudFormation to create and configure the network setup to be used by Amazon EC2 to visualize this feature. +This setup demonstrates a AWS Management Console Private Access connection to Amazon Simple Storage Service from an Amazon EC2 instance. The example uses CloudFormation to create the network configuration, and connects to the Amazon EC2 Windows instance through Fleet Manager (a capability of AWS Systems Manager) using the Remote Desktop Protocol (RDP). @@ -19,4 +16,0 @@ Copy the following CloudFormation template and save it to a file that you will u -###### Note - -This CloudFormation template uses configurations that are currently not supported in the Israel (Tel Aviv) Region. - @@ -31,20 +24,0 @@ This CloudFormation template uses configurations that are currently not supporte - - Ec2KeyPair: - Type: AWS::EC2::KeyPair::KeyName - Description: The EC2 KeyPair to use to connect to the Windows instance - - PublicSubnet1CIDR: - Type: String - Default: 172.16.1.0/24 - Description: CIDR range for Public Subnet A - - PublicSubnet2CIDR: - Type: String - Default: 172.16.0.0/24 - Description: CIDR range for Public Subnet B - - PublicSubnet3CIDR: - Type: String - Default: 172.16.2.0/24 - Description: CIDR range for Public Subnet C - @@ -53,3 +27,2 @@ This CloudFormation template uses configurations that are currently not supporte - Default: 172.16.4.0/24 - Description: CIDR range for Private Subnet A - + Default: 172.16.1.0/24 + Description: CIDR range for Private Subnet 1 @@ -58,8 +31,5 @@ This CloudFormation template uses configurations that are currently not supporte - Default: 172.16.5.0/24 - Description: CIDR range for Private Subnet B - - PrivateSubnet3CIDR: - Type: String - Default: 172.16.3.0/24 - Description: CIDR range for Private Subnet C - + Default: 172.16.2.0/24 + Description: CIDR range for Private Subnet 2 + Ec2KeyPair: + Type: AWS::EC2::KeyPair::KeyName + Description: The EC2 KeyPair to use to connect to the Windows instance @@ -67,3 +37,2 @@ This CloudFormation template uses configurations that are currently not supporte - Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>' - Default: '/aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base' - + Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> + Default: /aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base @@ -72,3 +41 @@ This CloudFormation template uses configurations that are currently not supporte - Default: 't3.medium' - - + Default: m5.large @@ -82 +49 @@ This CloudFormation template uses configurations that are currently not supporte - Type: 'AWS::EC2::VPC' + Type: AWS::EC2::VPC @@ -89,35 +56,2 @@ This CloudFormation template uses configurations that are currently not supporte - PublicSubnetA: - Type: 'AWS::EC2::Subnet' - Properties: - VpcId: !Ref AppVPC - CidrBlock: !Ref PublicSubnet1CIDR - MapPublicIpOnLaunch: true - AvailabilityZone: - Fn::Select: - - 0 - - Fn::GetAZs: "" - - PublicSubnetB: - Type: 'AWS::EC2::Subnet' - Properties: - VpcId: !Ref AppVPC - CidrBlock: !Ref PublicSubnet2CIDR - MapPublicIpOnLaunch: true - AvailabilityZone: - Fn::Select: - - 1 - - Fn::GetAZs: "" - - PublicSubnetC: - Type: 'AWS::EC2::Subnet' - Properties: - VpcId: !Ref AppVPC - CidrBlock: !Ref PublicSubnet3CIDR - MapPublicIpOnLaunch: true - AvailabilityZone: - Fn::Select: - - 2 - - Fn::GetAZs: "" - - PrivateSubnetA: - Type: 'AWS::EC2::Subnet' + PrivateSubnet1: + Type: AWS::EC2::Subnet @@ -132,2 +66,2 @@ This CloudFormation template uses configurations that are currently not supporte - PrivateSubnetB: - Type: 'AWS::EC2::Subnet' + PrivateSubnet2: + Type: AWS::EC2::Subnet @@ -142,29 +75,0 @@ This CloudFormation template uses configurations that are currently not supporte - PrivateSubnetC: - Type: 'AWS::EC2::Subnet' - Properties: - VpcId: !Ref AppVPC - CidrBlock: !Ref PrivateSubnet3CIDR - AvailabilityZone: - Fn::Select: - - 2 - - Fn::GetAZs: "" - - InternetGateway: - Type: AWS::EC2::InternetGateway - - InternetGatewayAttachment: - Type: AWS::EC2::VPCGatewayAttachment - Properties: - InternetGatewayId: !Ref InternetGateway - VpcId: !Ref AppVPC - - NatGatewayEIP: - Type: AWS::EC2::EIP - DependsOn: InternetGatewayAttachment - - NatGateway: - Type: AWS::EC2::NatGateway - Properties: - AllocationId: !GetAtt NatGatewayEIP.AllocationId - SubnetId: !Ref PublicSubnetA - @@ -176,30 +80,0 @@ This CloudFormation template uses configurations that are currently not supporte - Type: 'AWS::EC2::RouteTable' - Properties: - VpcId: !Ref AppVPC - - DefaultPrivateRoute: - Type: AWS::EC2::Route - Properties: - RouteTableId: !Ref PrivateRouteTable - DestinationCidrBlock: 0.0.0.0/0 - NatGatewayId: !Ref NatGateway - - PrivateSubnetRouteTableAssociation1: - Type: 'AWS::EC2::SubnetRouteTableAssociation' - Properties: - RouteTableId: !Ref PrivateRouteTable - SubnetId: !Ref PrivateSubnetA - - PrivateSubnetRouteTableAssociation2: - Type: 'AWS::EC2::SubnetRouteTableAssociation' - Properties: - RouteTableId: !Ref PrivateRouteTable - SubnetId: !Ref PrivateSubnetB - - PrivateSubnetRouteTableAssociation3: - Type: 'AWS::EC2::SubnetRouteTableAssociation' - Properties: - RouteTableId: !Ref PrivateRouteTable - SubnetId: !Ref PrivateSubnetC - - PublicRouteTable: @@ -210,9 +85 @@ This CloudFormation template uses configurations that are currently not supporte - DefaultPublicRoute: - Type: AWS::EC2::Route - DependsOn: InternetGatewayAttachment - Properties: - RouteTableId: !Ref PublicRouteTable - DestinationCidrBlock: 0.0.0.0/0 - GatewayId: !Ref InternetGateway - - PublicSubnetARouteTableAssociation1: + PrivateSubnet1RouteTableAssociation: @@ -221,8 +88,2 @@ This CloudFormation template uses configurations that are currently not supporte - RouteTableId: !Ref PublicRouteTable - SubnetId: !Ref PublicSubnetA - - PublicSubnetBRouteTableAssociation2: - Type: AWS::EC2::SubnetRouteTableAssociation - Properties: - RouteTableId: !Ref PublicRouteTable - SubnetId: !Ref PublicSubnetB + RouteTableId: !Ref PrivateRouteTable + SubnetId: !Ref PrivateSubnet1 @@ -230 +91 @@ This CloudFormation template uses configurations that are currently not supporte - PublicSubnetBRouteTableAssociation3: + PrivateSubnet2RouteTableAssociation: @@ -233,3 +94,2 @@ This CloudFormation template uses configurations that are currently not supporte - RouteTableId: !Ref PublicRouteTable