AWS awsconsolehelpdocs high security documentation change
Summary
Significantly refactored CloudFormation template: removed public subnets, NAT gateway, and Route53 resources; simplified subnet configuration; added explicit endpoint policies; consolidated private subnets; removed custom Lambda AZ resolution; changed VPC endpoint configurations.
Security assessment
The change adds explicit security policies to VPC endpoints that enforce account and VPC-level restrictions (Condition: aws:PrincipalAccount, aws:ResourceAccount, aws:SourceVpc). It enables private DNS for all endpoints and removes public-facing resources, reducing attack surface. The added endpoint policies represent concrete security improvements.
Diff
diff --git a/awsconsolehelpdocs/latest/gsg/test-console-private-access-workspaces.md b/awsconsolehelpdocs/latest/gsg/test-console-private-access-workspaces.md index b7b9cd338..b11177fa3 100644 --- a//awsconsolehelpdocs/latest/gsg/test-console-private-access-workspaces.md +++ b//awsconsolehelpdocs/latest/gsg/test-console-private-access-workspaces.md @@ -30,11 +28,0 @@ Copy the following CloudFormation template and save it to a file that you will u - - PublicSubnet1CIDR: - Type: String - Default: 172.16.1.0/24 - Description: CIDR range for Public Subnet A - - PublicSubnet2CIDR: - Type: String - Default: 172.16.0.0/24 - Description: CIDR range for Public Subnet B - @@ -43,3 +31,2 @@ Copy the following CloudFormation template and save it to a file that you will u - Default: 172.16.4.0/24 - Description: CIDR range for Private Subnet A - + Default: 172.16.1.0/24 + Description: CIDR range for Private Subnet 1 @@ -48,3 +35,2 @@ Copy the following CloudFormation template and save it to a file that you will u - Default: 172.16.5.0/24 - Description: CIDR range for Private Subnet B - + Default: 172.16.2.0/24 + Description: CIDR range for Private Subnet 2 @@ -55,45 +40,0 @@ Copy the following CloudFormation template and save it to a file that you will u - - # Amazon WorkSpaces is available in a subset of the Availability Zones for each supported Region. - # https://docs.aws.amazon.com/workspaces/latest/adminguide/azs-workspaces.html - Mappings: - RegionMap: - us-east-1: - az1: use1-az2 - az2: use1-az4 - az3: use1-az6 - us-west-2: - az1: usw2-az1 - az2: usw2-az2 - az3: usw2-az3 - ap-south-1: - az1: aps1-az1 - az2: aps1-az2 - az3: aps1-az3 - ap-northeast-2: - az1: apne2-az1 - az2: apne2-az3 - ap-southeast-1: - az1: apse1-az1 - az2: apse1-az2 - ap-southeast-2: - az1: apse2-az1 - az2: apse2-az3 - ap-northeast-1: - az1: apne1-az1 - az2: apne1-az4 - ca-central-1: - az1: cac1-az1 - az2: cac1-az2 - eu-central-1: - az1: euc1-az2 - az2: euc1-az3 - eu-west-1: - az1: euw1-az1 - az2: euw1-az2 - eu-west-2: - az1: euw2-az2 - az2: euw2-az3 - sa-east-1: - az1: sae1-az1 - az2: sae1-az3 - @@ -102,68 +42,0 @@ Copy the following CloudFormation template and save it to a file that you will u - iamLambdaExecutionRole: - Type: AWS::IAM::Role - Properties: - AssumeRolePolicyDocument: - Version: 2012-10-17 - Statement: - - Effect: Allow - Principal: - Service: - - lambda.amazonaws.com - Action: - - 'sts:AssumeRole' - ManagedPolicyArns: - - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole - Policies: - - PolicyName: describe-ec2-az - PolicyDocument: - Version: "2012-10-17" - Statement: - - Effect: Allow - Action: - - 'ec2:DescribeAvailabilityZones' - Resource: '*' - MaxSessionDuration: 3600 - Path: /service-role/ - - fnZoneIdtoZoneName: - Type: AWS::Lambda::Function - Properties: - Runtime: python3.8 - Handler: index.lambda_handler - Code: - ZipFile: | - import boto3 - import cfnresponse - - def zoneId_to_zoneName(event, context): - responseData = {} - ec2 = boto3.client('ec2') - describe_az = ec2.describe_availability_zones() - for az in describe_az['AvailabilityZones']: - if event['ResourceProperties']['ZoneId'] == az['ZoneId']: - responseData['ZoneName'] = az['ZoneName'] - cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, str(az['ZoneId'])) - - def no_op(event, context): - print(event) - responseData = {} - cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, str(event['RequestId'])) - - def lambda_handler(event, context): - if event['RequestType'] == ('Create' or 'Update'): - zoneId_to_zoneName(event, context) - else: - no_op(event,context) - Role: !GetAtt iamLambdaExecutionRole.Arn - - getAZ1: - Type: "Custom::zone-id-zone-name" - Properties: - ServiceToken: !GetAtt fnZoneIdtoZoneName.Arn - ZoneId: !FindInMap [ RegionMap, !Ref 'AWS::Region', az1 ] - getAZ2: - Type: "Custom::zone-id-zone-name" - Properties: - ServiceToken: !GetAtt fnZoneIdtoZoneName.Arn - ZoneId: !FindInMap [ RegionMap, !Ref 'AWS::Region', az2 ] - @@ -175 +48 @@ Copy the following CloudFormation template and save it to a file that you will u - Type: 'AWS::EC2::VPC' + Type: AWS::EC2::VPC @@ -182,18 +55,2 @@ Copy the following CloudFormation template and save it to a file that you will u - PublicSubnetA: - Type: 'AWS::EC2::Subnet' - Properties: - VpcId: !Ref AppVPC - CidrBlock: !Ref PublicSubnet1CIDR - MapPublicIpOnLaunch: true - AvailabilityZone: !GetAtt getAZ1.ZoneName - - PublicSubnetB: - Type: 'AWS::EC2::Subnet' - Properties: - VpcId: !Ref AppVPC - CidrBlock: !Ref PublicSubnet2CIDR - MapPublicIpOnLaunch: true - AvailabilityZone: !GetAtt getAZ2.ZoneName - - PrivateSubnetA: - Type: 'AWS::EC2::Subnet' + PrivateSubnet1: + Type: AWS::EC2::Subnet @@ -203 +60,4 @@ Copy the following CloudFormation template and save it to a file that you will u - AvailabilityZone: !GetAtt getAZ1.ZoneName + AvailabilityZone: + Fn::Select: + - 0 + - Fn::GetAZs: "" @@ -205,2 +65,2 @@ Copy the following CloudFormation template and save it to a file that you will u - PrivateSubnetB: - Type: 'AWS::EC2::Subnet' + PrivateSubnet2: + Type: AWS::EC2::Subnet @@ -210,20 +70,4 @@ Copy the following CloudFormation template and save it to a file that you will u - AvailabilityZone: !GetAtt getAZ2.ZoneName - - InternetGateway: - Type: AWS::EC2::InternetGateway - - InternetGatewayAttachment: - Type: AWS::EC2::VPCGatewayAttachment - Properties: - InternetGatewayId: !Ref InternetGateway - VpcId: !Ref AppVPC - - NatGatewayEIP: - Type: AWS::EC2::EIP - DependsOn: InternetGatewayAttachment - - NatGateway: - Type: AWS::EC2::NatGateway - Properties: - AllocationId: !GetAtt NatGatewayEIP.AllocationId - SubnetId: !Ref PublicSubnetA + AvailabilityZone: