AWS vpc documentation change
Summary
Changed 'Availability Zone independence' to 'Availability Zone isolation' in AZ-aware routing prerequisites section
Security assessment
Terminology change from 'independence' to 'isolation' clarifies networking behavior but doesn't address any security vulnerability. No evidence of security incident or vulnerability mitigation.
Diff
diff --git a/vpc/latest/tgw/tgw-vpc-attachments.md b/vpc/latest/tgw/tgw-vpc-attachments.md index 21cd83549..3abf092f3 100644 --- a//vpc/latest/tgw/tgw-vpc-attachments.md +++ b//vpc/latest/tgw/tgw-vpc-attachments.md @@ -115 +115 @@ Appliance mode is only supported for VPC attachments. -Prerequisites for AZ-aware routing: Route propagation must be enabled for the transit gateway route table associated with the appliance-mode VPC attachment. Without propagation, the transit gateway cannot determine the source and destination Availability Zones. All traffic—including the same-Availability-Zone flows described in Scenario 1—falls back to flow-hash-based Availability Zone selection. This means traffic within the same Availability Zone might be routed to a different Availability Zone in the appliance VPC, breaking Availability Zone independence. +Prerequisites for AZ-aware routing: Route propagation must be enabled for the transit gateway route table associated with the appliance-mode VPC attachment. Without propagation, the transit gateway cannot determine the source and destination Availability Zones. All traffic—including the same-Availability-Zone flows described in Scenario 1—falls back to flow-hash-based Availability Zone selection. This means traffic within the same Availability Zone might be routed to a different Availability Zone in the appliance VPC, breaking Availability Zone isolation.