AWS pcs documentation change
Summary
Added DNS resolution requirements for dual-stack endpoints and updated endpoint examples.
Security assessment
The changes provide operational guidance for endpoint configuration but don't address security vulnerabilities or document security features. Proper DNS resolution prevents connectivity issues but isn't a security control.
Diff
diff --git a/pcs/latest/userguide/vpc-interface-endpoints.md b/pcs/latest/userguide/vpc-interface-endpoints.md index 93d56e396..59d4e9689 100644 --- a//pcs/latest/userguide/vpc-interface-endpoints.md +++ b//pcs/latest/userguide/vpc-interface-endpoints.md @@ -22,0 +23,11 @@ AWS PCS supports making calls to all of its API actions through the interface en +###### Dual-stack endpoint requirement + +By default, the AWS PCS agent connects to the dual-stack (IPv4 and IPv6) endpoint `pcs.`region`.api.aws`. This name must resolve to the private IP address of an interface VPC endpoint in your VPC. Replace `region` with the ID of the AWS Region, such as `us-east-1`. + + * If you use the Amazon-provided DNS, keep **Enable DNS name** selected under **Additional settings** when you create the endpoint, and make sure that DNS hostnames and DNS resolution are enabled for the VPC. + + * If you use custom DNS, make sure that it can resolve `pcs.`region`.api.aws` to the endpoint. + + + + @@ -36 +47 @@ Replace `region` with the ID of the AWS Region to create the endpoint in, such a -If you enable private DNS for the interface endpoint, you can make API requests to AWS PCS using its default Regional DNS name. For example, `pcs.us-east-1.amazonaws.com`. +If you enable private DNS for the interface endpoint, you can make API requests to AWS PCS using its Regional DNS name. For example, `pcs.us-east-1.api.aws`.