AWS AWSEC2 documentation change
Summary
Added requirement for outbound traffic to EC2 Instance Connect proxy endpoint
Security assessment
Documents network requirements for secure connection proxy but doesn't address a specific vulnerability. Adds security-related documentation about connectivity requirements for a security feature (EC2 Instance Connect).
Diff
diff --git a/AWSEC2/latest/UserGuide/ec2-instance-connect-prerequisites.md b/AWSEC2/latest/UserGuide/ec2-instance-connect-prerequisites.md index 3435982e3..5dde43d32 100644 --- a//AWSEC2/latest/UserGuide/ec2-instance-connect-prerequisites.md +++ b//AWSEC2/latest/UserGuide/ec2-instance-connect-prerequisites.md @@ -7 +7 @@ -Install EC2 Instance ConnectEnsure network connectivityAllow inbound SSH trafficGrant permissionsInstall an SSH client on your local computerMeet username requirements +Install EC2 Instance ConnectEnsure network connectivityAllow outbound traffic to the EC2 Instance Connect proxyAllow inbound SSH trafficGrant permissionsInstall an SSH client on your local computerMeet username requirements @@ -16,0 +17,2 @@ Install EC2 Instance ConnectEnsure network connectivityAllow inbound SSH traffic + * Allow outbound traffic to the EC2 Instance Connect proxy + @@ -44,0 +47,15 @@ If your instance does not have a public IPv4 or IPv6 address and you prefer not +## Allow outbound traffic to the EC2 Instance Connect proxy + +When you connect to an instance using the Amazon EC2 console, your browser establishes a WebSocket connection on port 443 to the EC2 Instance Connect proxy service at the following Region-specific endpoint: + + * `prod.`region`.oneclickv2-proxy.ec2.aws.dev` + + + + +For example, for the US East (N. Virginia) Region, the endpoint is `prod.us-east-1.oneclickv2-proxy.ec2.aws.dev`. + +###### Note + +Your browser must be able to reach this endpoint. If a firewall or VPN blocks the connection, the connection fails. +