AWS elasticloadbalancing documentation change
Summary
Added warning about ENI connection tracking timeout mismatch when setting Gateway LB idle timeout above 350 seconds
Security assessment
The change addresses connection reliability (silent connection drops due to timeout mismatches) rather than security vulnerabilities. While important for service availability, there's no evidence of exploitation vectors or security weaknesses being mitigated.
Diff
diff --git a/elasticloadbalancing/latest/gateway/update-idle-timeout.md b/elasticloadbalancing/latest/gateway/update-idle-timeout.md index 519a8bb59..cc7e37c52 100644 --- a//elasticloadbalancing/latest/gateway/update-idle-timeout.md +++ b//elasticloadbalancing/latest/gateway/update-idle-timeout.md @@ -10,0 +11,5 @@ For each TCP request made through a Gateway Load Balancer, the state of that con + * If you set the idle timeout higher than 350 seconds, verify that your targets' ENI connection tracking idle timeout (`TcpEstablishedTimeout`) is equal to or greater than the Gateway Load Balancer idle timeout value. On Nitro V6+ instances, the default connection tracking timeout is 350 seconds. A mismatch causes the target's network interface to silently drop connection state before the load balancer closes the connection. For more information, see [Best Practices for TCP Connection Management on EC2](https://aws.amazon.com/blogs/networking-and-content-delivery/best-practices-for-tcp-connection-management-on-ec2/). + + + +