AWS directoryservice documentation change
Summary
Added IPv6 examples and network configuration requirements for RADIUS servers used in MFA, including routing, NACLs, and internet gateway requirements for directories created after October 2025.
Security assessment
The change adds documentation about network security requirements for RADIUS-based MFA systems to prevent authentication failures. While it enhances security documentation, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/directoryservice/latest/admin-guide/ms_ad_mfa.md b/directoryservice/latest/admin-guide/ms_ad_mfa.md index 3f26cc29b..7b8f22ec2 100644 --- a//directoryservice/latest/admin-guide/ms_ad_mfa.md +++ b//directoryservice/latest/admin-guide/ms_ad_mfa.md @@ -72 +72,11 @@ _**RADIUS server DNS name or IP addresses**_ -The IP addresses of your RADIUS server endpoints, or the IP address of your RADIUS server load balancer. You can enter multiple IP addresses by separating them with a comma (e.g., `192.0.0.0,192.0.0.12`). +The IP addresses of your RADIUS server endpoints, or the IP address of your RADIUS server load balancer. You can enter multiple IP addresses by separating them with a comma (e.g., `192.0.0.0,192.0.0.12` or `2001:db8::1,2001:db8::2`). + +###### Important + +Directories created after October 7, 2025, require that RADIUS servers used for multi-factor authentication be routable through your VPC's network configuration. If your RADIUS server is not accessible via your VPC's routing tables, security groups, and network ACLs, multi-factor authentication will fail during multi-factor authentication checks. To resolve this issue, ensure that: + + * **Network Routing:** Your VPC route tables allow traffic to reach your RADIUS server from the subnets where your AWS Managed Microsoft AD directory instances are deployed. + + * **Network ACLs:** Your subnet network ACLs allow bidirectional traffic to/from your RADIUS server. + + * **Internet Gateway/NAT:** If your RADIUS server is internet-facing, ensure your VPC has appropriate internet gateway or NAT gateway configuration for the directory subnets. If your network type is IPv4, you will need to have NAT and internet gateway configured with your VPC.