AWS prescriptive-guidance documentation change
Summary
Updated documentation formatting and grammar: fixed apostrophe usage, corrected markdown table syntax, adjusted section headers, and updated internal links. Added proper markdown formatting for query examples and improved code spacing.
Security assessment
Changes are primarily grammatical improvements and markdown formatting fixes. No security vulnerabilities or specific security enhancements are addressed. The content maintains existing security guidance about VPC Flow Logs analysis without introducing new security concepts or mitigations.
Diff
diff --git a/prescriptive-guidance/latest/secure-outbound-network-traffic/vpc-security-requirements.md b/prescriptive-guidance/latest/secure-outbound-network-traffic/vpc-security-requirements.md index 77aa6ef4e..68c9dd9a9 100644 --- a//prescriptive-guidance/latest/secure-outbound-network-traffic/vpc-security-requirements.md +++ b//prescriptive-guidance/latest/secure-outbound-network-traffic/vpc-security-requirements.md @@ -5 +5 @@ -[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Secure your VPC’s outbound network traffic in the AWS Cloud](welcome.html) +[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Secure your VPC’s outbound network traffic in the AWS Cloud](introduction.html) @@ -7 +7 @@ -Best practices for analyzing your VPC’s outbound traffic when using VPC Flow Logs +Best practices for analyzing your VPC's outbound traffic when using VPC Flow Logs @@ -9 +9 @@ Best practices for analyzing your VPC’s outbound traffic when using VPC Flow L -# Determining your VPC’s security requirements +# Determining your VPC's security requirements @@ -13 +13 @@ Best practices for analyzing your VPC’s outbound traffic when using VPC Flow L -It’s a best practice to design and test your VPC’s outbound traffic security architecture in a test environment. Testing architecture changes in a development environment mitigates the risk of pushing unintended system behaviors live. +It's a best practice to design and test your VPC's outbound traffic security architecture in a test environment. Testing architecture changes in a development environment mitigates the risk of pushing unintended system behaviors live. @@ -15 +15 @@ It’s a best practice to design and test your VPC’s outbound traffic security -Before making changes to your network’s outbound traffic patterns, it’s important to understand the traffic patterns that your application needs to operate as intended. This information can help you identify which traffic patterns to allow and which ones to deny when rearchitecting your network. +Before making changes to your network's outbound traffic patterns, it's important to understand the traffic patterns that your application needs to operate as intended. This information can help you identify which traffic patterns to allow and which ones to deny when rearchitecting your network. @@ -17 +17 @@ Before making changes to your network’s outbound traffic patterns, it’s impo -To analyze your VPC’s existing outbound traffic patterns, first turn on [VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html). Then, use a test environment to run your application through various usage scenarios and analyze the simulated traffic in the flow logs. +To analyze your VPC's existing outbound traffic patterns, first turn on [VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html). Then, use a test environment to run your application through various usage scenarios and analyze the simulated traffic in the flow logs. @@ -19 +19 @@ To analyze your VPC’s existing outbound traffic patterns, first turn on [VPC F -VPC Flow Logs record your VPC’s inbound and outbound IP traffic. Amazon VPC then sends the logs to either Amazon Simple Storage Service (Amazon S3) or Amazon CloudWatch. You can view and analyze the logs by using either of the following tools: +VPC Flow Logs record your VPC's inbound and outbound IP traffic. Amazon VPC then sends the logs to either Amazon Simple Storage Service (Amazon S3) or Amazon CloudWatch. You can view and analyze the logs by using either of the following tools: @@ -43 +43 @@ For details on the types of information that VPC Flow Logs capture, see [Flow lo -VPC Flow Logs don’t capture application layer (layer 7) information, such as DNS hostnames. If your security requirements call for the analysis of application layer data, you can deploy [AWS Network Firewall](https://aws.amazon.com/network-firewall/) to capture the required details. For more information, see the **Restricting a VPC’s outbound traffic by using AWS Network Firewall and DNS hostnames** section of this guide. +VPC Flow Logs don't capture application layer (layer 7) information, such as DNS hostnames. If your security requirements call for the analysis of application layer data, you can deploy [AWS Network Firewall](https://aws.amazon.com/network-firewall/) to capture the required details. For more information, see the **Restricting a VPC's outbound traffic by using AWS Network Firewall and DNS hostnames** section of this guide. @@ -45 +45 @@ VPC Flow Logs don’t capture application layer (layer 7) information, such as D -## Best practices for analyzing your VPC’s outbound traffic when using VPC Flow Logs +## Best practices for analyzing your VPC's outbound traffic when using VPC Flow Logs @@ -51 +51 @@ When analyzing your VPC flow logs by using either Amazon Athena or CloudWatch Lo - * Identify and analyze the application traffic flowing through the network interface that’s attached to the NAT gateway. + * Identify and analyze the application traffic flowing through the network interface that's attached to the NAT gateway. @@ -53 +53 @@ When analyzing your VPC flow logs by using either Amazon Athena or CloudWatch Lo - * Make sure that you capture all outbound traffic for a network interface by making the source address in your query the network interface’s private IP address. + * Make sure that you capture all outbound traffic for a network interface by making the source address in your query the network interface's private IP address. @@ -64 +64 @@ When analyzing your VPC flow logs by using either Amazon Athena or CloudWatch Lo -If you’re working with Amazon Athena for the first time, make sure that you configure a query result location. For instructions, see [Specifying a query result location using the Athena console](https://docs.aws.amazon.com/athena/latest/ug/querying.html#query-results-specify-location-console) in the _Amazon Athena User Guide_. +If you're working with Amazon Athena for the first time, make sure that you configure a query result location. For instructions, see [Specifying a query result location using the Athena console](https://docs.aws.amazon.com/athena/latest/ug/querying.html#query-results-specify-location-console) in the _Amazon Athena User Guide_. @@ -66 +66 @@ If you’re working with Amazon Athena for the first time, make sure that you co -_Amazon Athena query examples_ +### Amazon Athena query examples @@ -81 +81 @@ The following Athena query returns the first 200 lines of outbound admin traffic -**#** | 1 +#| 1 @@ -124 +124 @@ The following Athena query returns the external IP addresses and ports that rece -**#**| **Dstport**| **Dstaddr**| **count** +#| Dstport| Dstaddr| count @@ -135 +135 @@ The following Athena query returns the rejected outbound traffic from a VPC with - SELECT * + SELECT * @@ -137 +137 @@ The following Athena query returns the rejected outbound traffic from a VPC with - FROM "<vpc_flow_logs_table_name>" + FROM "<vpc_flow_logs_table_name>" @@ -143 +143 @@ The following Athena query returns the rejected outbound traffic from a VPC with -**#** | 1 +#| 1 @@ -167 +167 @@ For more information about how to interpret Athena query results, see [Flow log -_CloudWatch Logs Insights query examples_ +### CloudWatch Logs Insights query examples @@ -186 +186 @@ The following CloudWatch Logs Insights query returns the first 200 results of ou -**Field**| **Value** +Field| Value @@ -225 +225 @@ The following CloudWatch Logs Insights query returns the external IP addresses a -**#**| **dstAddr**| **dstPort**| **count** +#| dstAddr| dstPort| count @@ -243 +243 @@ The following CloudWatch Logs Insights query returns the rejected outbound traff -**Field**| **Value** +Field| Value @@ -273 +273 @@ Introduction -Restricting a VPC’s outbound traffic +Restricting a VPC's outbound traffic