AWS elasticloadbalancing medium security documentation change
Summary
Added warning about verifying ENI connection tracking timeout when setting idle timeout >350 seconds to prevent silent connection drops
Security assessment
The change addresses a potential security-impacting reliability issue where mismatched timeouts cause silent connection drops. This could lead to availability issues that might be exploited in DoS scenarios or cause unexpected service interruptions.
Diff
diff --git a/elasticloadbalancing/latest/network/update-idle-timeout.md b/elasticloadbalancing/latest/network/update-idle-timeout.md index aa7c4510f..4d77ad31c 100644 --- a//elasticloadbalancing/latest/network/update-idle-timeout.md +++ b//elasticloadbalancing/latest/network/update-idle-timeout.md @@ -16,0 +17,2 @@ For each TCP request made through a Network Load Balancer, the state of that con + * If you set the idle timeout higher than 350 seconds, verify that your targets' ENI connection tracking idle timeout (`TcpEstablishedTimeout`) is equal to or greater than the Network Load Balancer idle timeout value. On Nitro V6+ instances, the default connection tracking timeout is 350 seconds. A mismatch causes the target's network interface to silently drop connection state before the load balancer closes the connection. For more information, see [Best Practices for TCP Connection Management on EC2](https://aws.amazon.com/blogs/networking-and-content-delivery/best-practices-for-tcp-connection-management-on-ec2/). +