AWS prescriptive-guidance documentation change
Summary
Updated breadcrumb navigation link and reformatted FAQ section headers from bold text to H2 markdown. Minor text edits for consistency and clarity.
Security assessment
Changes are structural/editorial (formatting headers, breadcrumb links, typo fixes). No security vulnerabilities, weaknesses, or incidents are mentioned. Content describes standard network firewall deployment patterns without introducing new security concepts.
Diff
diff --git a/prescriptive-guidance/latest/migration-perimeter-zone-apps-network-firewall/faq.md b/prescriptive-guidance/latest/migration-perimeter-zone-apps-network-firewall/faq.md index 9f16ee1cc..d6bbff769 100644 --- a//prescriptive-guidance/latest/migration-perimeter-zone-apps-network-firewall/faq.md +++ b//prescriptive-guidance/latest/migration-perimeter-zone-apps-network-firewall/faq.md @@ -5 +5,3 @@ -[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Migrating perimeter zone applications to the AWS Cloud using Network Firewall](welcome.html) +[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Migrating perimeter zone applications to the AWS Cloud using AWS Network Firewall](introduction.html) + +Do I need a load balancer to route internet traffic through a firewall in a multi-AZ deployment?If the Application Load Balancer isn't in a public subnet (routed to an internet gateway), then is it an internal Application Load Balancer?Does Network Firewall need its own security subnet?Is the target architecture valid for both ingress and egress traffic firewalling? @@ -9 +11 @@ -**Do I need a load balancer to route internet traffic through a firewall in a multi-AZ deployment?** +## Do I need a load balancer to route internet traffic through a firewall in a multi-AZ deployment? @@ -11 +13 @@ -AWS Network Firewall is transparent to incoming and outgoing traffic and doesn't require a load balancer for itself. A load balancer is only required for the application (as in a standard multi-AZ deployment). In this guide's perimeter zone architecture, Network Firewall is inserted through route tables and the corresponding network interfaces in the public subnet. +Network Firewall is transparent to incoming and outgoing traffic and doesn't require a load balancer for itself. A load balancer is only required for the application (as in a standard multi-AZ deployment). In this guide's perimeter zone architecture, Network Firewall is inserted through route tables and the corresponding network interfaces in the public subnet. @@ -13 +15 @@ AWS Network Firewall is transparent to incoming and outgoing traffic and doesn't -**If the Application Load Balancer isn't in a public subnet (routed to an internet gateway), then is it an internal Application Load Balancer?** +## If the Application Load Balancer isn't in a public subnet (routed to an internet gateway), then is it an internal Application Load Balancer? @@ -15 +17 @@ AWS Network Firewall is transparent to incoming and outgoing traffic and doesn't -The Application Load Balancer isn’t an internal Application Load Balancer. The Application Load Balancer continues to the external, internet-facing subnet, even if the subnet isn't directly connected to the internet. The subnet is transparently available to the internet because the routing from the endpoint's subnet to the public subnet is based on the network interface of Network Firewall. +The Application Load Balancer isn't an internal Application Load Balancer. The Application Load Balancer continues to the external, internet-facing subnet, even if the subnet isn't directly connected to the internet. The subnet is transparently available to the internet because the routing from the endpoint's subnet to the public subnet is based on the network interface of Network Firewall. @@ -17 +19 @@ The Application Load Balancer isn’t an internal Application Load Balancer. The -**Does Network Firewall need its own security subnet?** +## Does Network Firewall need its own security subnet? @@ -21 +23 @@ Yes, Network Firewall needs its own security subnet. The security subnet (public -**Is the target architecture valid for both ingress and egress traffic firewalling?** +## Is the target architecture valid for both ingress and egress traffic firewalling? @@ -23 +25 @@ Yes, Network Firewall needs its own security subnet. The security subnet (public -Yes, the target architecture is valid for both ingress and egress traffic firewalling. If a connection is initiated from the application to outside the VPC, then you must add a NAT gateway to the endpoint's subnet. Also, you must forward the traffic from the application's subnet to the NAT gateway by using a route table (as illustrated by**Route table app** in the diagram from the [Perimeter zone architecture based on Network Firewall](./architecture.html#perimeter-zone-applications-network-firewall) section of this guide.). Then, no further changes are required because all the outgoing traffic still goes through Network Firewall. +Yes, the target architecture is valid for both ingress and egress traffic firewalling. If a connection is initiated from the application to outside the VPC, then you must add a NAT gateway to the endpoint's subnet. Also, you must forward the traffic from the application's subnet to the NAT gateway by using a route table (as illustrated by**Route table app** in the diagram from the _Perimeter zone architecture based on Network Firewall_ section of this guide.). Then, no further changes are required because all the outgoing traffic still goes through Network Firewall.