AWS vpc medium security documentation change
Summary
Added account/organization-level encryption controls, CLI commands, and Gateway Load Balancer/Firewall limitations
Security assessment
Documents new encryption enforcement capabilities that prevent unencrypted resource creation. Explicitly mentions security controls (enforce mode blocking unencrypted resources) and adds security-focused CLI commands. Gateway Load Balancer/Firewall exclusion indicates security feature limitations.
Diff
diff --git a/vpc/latest/userguide/vpc-encryption-controls.md b/vpc/latest/userguide/vpc-encryption-controls.md index 3185e2e80..eb615ca3e 100644 --- a//vpc/latest/userguide/vpc-encryption-controls.md +++ b//vpc/latest/userguide/vpc-encryption-controls.md @@ -222,0 +223,4 @@ This functionality is supported in new clusters for 4.1 in their own VPC. The fo +###### Gateway Load Balancer and AWS Network Firewall + +Gateway Load Balancer and AWS Network Firewall are not supported with VPCs in enforce mode. If these resources are present in your VPC, you must run your VPC in monitor mode. + @@ -252,0 +257,58 @@ For more details on Transit Gateway encryption support, see [the transit gateway +### Enable VPC Encryption Controls at the Account level + +Account-level VPC Encryption Controls allow you to set the encryption control mode and resource exclusions that apply to all VPCs in your account. This provides centralized management of encryption policies without needing to configure each VPC individually. + +Account-level encryption controls support the same eight resource exclusions as VPC-level controls: Internet Gateway, NAT Gateway, Egress-only Internet Gateway, VPC Peering, Virtual Private Gateway, Lambda, VPC Lattice, and Elastic File System. + +#### Account-level Encryption Controls modes + +You can set the following modes at the account level: + +**Unmanaged** + + +VPC Encryption Controls remain in their current mode and can be managed at the VPC level. + +**Attempt Monitor** + + +Attempts to transition all VPCs in the account to monitor mode. Identifies unencrypted resources without blocking creation. + +**Attempt Enforce** + + +Attempts to transition all VPCs in the account to enforce mode. Blocks creation of unencrypted resources. + +#### Account-level Encryption Controls states + +Account-level VPC Encryption Controls can have one of the following states: + +**default-state** + + +The account-level VPC Encryption Control has not been enabled. + +**transitions-in-progress** + + +The VPCs in the account are being transitioned to the specified mode. + +**transitions-partially-successful** + + +One or more VPCs did not transition to the expected mode. + +**transitions-successful** + + +All VPCs successfully transitioned to the expected mode. + +**transitions-failed** + + +All VPCs failed to transition to the expected mode. + +### Enable VPC Encryption Controls at the Organization level + +If you are using AWS Organizations to manage accounts in your organization, you can use an [AWS Organizations declarative policy](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative_policies.html) to enforce VPC Encryption Controls on the accounts in the organization. For more information about the VPC Encryption Controls declarative policy, see [Supported declarative policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ec2_syntax.html#declarative-policy-vpc-block-public-access) in the AWS Organizations User Guide. + @@ -264,0 +327,4 @@ For pricing information, see the [Amazon VPC Pricing](https://aws.amazon.com/vpc + * [aws ec2 modify-account-vpc-encryption-control](https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-account-vpc-encryption-control.html) + + * [aws ec2 describe-account-vpc-encryption-control](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-account-vpc-encryption-control.html) +