AWS vpc medium security documentation change
Summary
Added critical note about route propagation requirements for AZ-aware routing in appliance mode
Security assessment
Highlights misconfiguration risk where traffic could bypass AZ isolation (security boundary) if route propagation isn't enabled
Diff
diff --git a/vpc/latest/tgw/tgw-vpc-attachments.md b/vpc/latest/tgw/tgw-vpc-attachments.md index 177b3c280..21cd83549 100644 --- a//vpc/latest/tgw/tgw-vpc-attachments.md +++ b//vpc/latest/tgw/tgw-vpc-attachments.md @@ -111 +111,9 @@ If you plan to configure a stateful network appliance in your VPC, you can enabl -Appliance mode in AWS Transit Gateway optimizes traffic routing by considering the source and destination Availability Zones when determining the path through an appliance mode VPC. This approach enhances efficiency and reduces latency. The behavior varies depending on the specific configuration and traffic patterns. The following are example scenarios. +###### Important + +Appliance mode is only supported for VPC attachments. + +Prerequisites for AZ-aware routing: Route propagation must be enabled for the transit gateway route table associated with the appliance-mode VPC attachment. Without propagation, the transit gateway cannot determine the source and destination Availability Zones. All traffic—including the same-Availability-Zone flows described in Scenario 1—falls back to flow-hash-based Availability Zone selection. This means traffic within the same Availability Zone might be routed to a different Availability Zone in the appliance VPC, breaking Availability Zone independence. + +Appliance mode in AWS Transit Gateway optimizes traffic routing by considering the source and destination Availability Zones when determining the path through an appliance mode VPC. This approach enhances efficiency and reduces latency. The behavior varies depending on the specific configuration and traffic patterns. + +The following scenarios assume that route propagation is enabled for the transit gateway route table associated with the appliance-mode VPC attachment. Without propagation, the transit gateway cannot determine the source and destination Availability Zones, and all scenarios default to flow-hash-based Availability Zone selection (the behavior described in Scenario 2). @@ -123 +131 @@ For traffic flowing from source Availability Zone us-east-1a to destination Avai -When traffic originates from source Availability Zone us-east-1a to a destination without Availability Zone information (e.g., internet-bound traffic), with Appliance Mode VPC attachments in both us-east-1a and us-east-1b, Transit Gateway selects a network interface from us-east-1a within the appliance VPC. +When traffic originates from source Availability Zone us-east-1a to a destination without Availability Zone information (for example, internet-bound traffic), with Appliance Mode VPC attachments in both us-east-1a and us-east-1b, Transit Gateway selects a network interface from us-east-1a within the appliance VPC. @@ -129,4 +136,0 @@ When traffic flows from source Availability Zone us-east-1a to destination Avail -###### Note - -Appliance mode is only supported for VPC attachments. Ensure that route propagation is enabled for a route table associated with an appliance VPC attachment. -