AWS prescriptive-guidance documentation change
Summary
Updated image paths, fixed markdown table formatting, corrected punctuation in URLs, and adjusted documentation about service link security configurations. Added line break in firewall port table and fixed footnote formatting.
Security assessment
Changes primarily focus on documentation formatting and image reorganization. While the content discusses security configurations, the changes themselves don't introduce new security information or address specific vulnerabilities. The firewall port table formatting change doesn't alter security guidance.
Diff
diff --git a/prescriptive-guidance/latest/hybrid-cloud-best-practices/security.md b/prescriptive-guidance/latest/hybrid-cloud-best-practices/security.md index 151a4fe7d..ff759e356 100644 --- a//prescriptive-guidance/latest/hybrid-cloud-best-practices/security.md +++ b//prescriptive-guidance/latest/hybrid-cloud-best-practices/security.md @@ -46 +46 @@ Amazon S3 on Outposts doesn't support server-side encryption with KMS keys (SSE- -For AWS Outposts, the service link is a necessary connection between your Outposts server and your chosen AWS Region (or home Region) and allows for the management of the Outpost and the exchange of traffic to and from the AWS Region. The service link uses an AWS managed VPN to communicate with the home Region. Each host inside AWS Outposts creates a set of VPN tunnels to split control plane traffic and VPC traffic. Depending on the service link connectivity (internet or Direct Connect) for AWS Outposts, those tunnels require firewall ports to be opened for the service link to create the overlay on top of it. For detailed technical information about the security of AWS Outposts and the service link, see [Connectivity through service link](https://docs.aws.amazon.com/outposts/latest/userguide/service-links.html) and [Infrastructure security in AWS Outposts](https://docs.aws.amazon.com/outposts/latest/server-userguide/infrastructure-security.html) in the AWS Outposts documentation. +For AWS Outposts, the service link is a necessary connection between your Outposts server and your chosen AWS Region (or home Region) and allows for the management of the Outpost and the exchange of traffic to and from the AWS Region. The service link uses an AWS managed VPN to communicate with the home Region. Each host inside AWS Outposts creates a set of VPN tunnels to split control plane traffic and VPC traffic. Depending on the service link connectivity (internet or Direct Connect) for AWS Outposts, those tunnels require firewall ports to be opened for the service link to create the overlay on top of it. For detailed technical information about the security of AWS Outposts and the service link, see [Connectivity through service link](https://docs.aws.amazon.com/outposts/latest/userguide/service-links.html) and [Infrastructure security in AWS Outposts](https://docs.aws.amazon.com/outposts/latest/server-userguide/infrastructure-security.html) in the AWS Outposts documentation[.](https://docs.aws.amazon.com/outposts/latest/server-userguide/infrastructure-security.html) @@ -50 +50 @@ The AWS Outposts service link creates encrypted tunnels that establish control p - + @@ -54 +54 @@ Each AWS Outposts host (compute and storage) requires these encrypted tunnels ov -**Protocol** | **Source port** | **Source address** | **Destination port** | **Destination address** +Protocol| Source port| Source address| Destination port| Destination address @@ -58,0 +59,2 @@ TCP | 1025-65535 | AWS Outposts service link /26 | 443 | AWS Outposts Region's p +**** + @@ -65 +67 @@ When you stop or terminate an EC2 instance in AWS Outposts, the memory allocated - + @@ -73 +75 @@ The following table lists the IAM features that you can use with AWS Outposts. -**IAM feature** | **AWS Outposts support** +IAM feature| AWS Outposts support @@ -87 +89 @@ Service-linked roles | Yes -***** In addition to IAM identity-based policies, Amazon S3 on Outposts supports both bucket and access point policies. These are [resource-based policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html) that are attached to the Amazon S3 on Outposts resource. +*In addition to IAM identity-based policies, Amazon S3 on Outposts supports both bucket and access point policies. These are [resource-based policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html) that are attached to the Amazon S3 on Outposts resource. @@ -141 +143 @@ The following diagram shows traffic between the workload in the AWS Outposts ins - + @@ -149 +151 @@ The following image shows traffic between a workload in the AWS Outposts subnet - +