AWS network-manager: Clarify Cloud WAN segment action edge overrides and routing policy rule ordering

Service: network-manager · 2026-09-27 · Documentation low

File: network-manager/latest/cloudwan/cloudwan-policies-json.md · Type: network

Summary

Expands the `with-edge-overrides` parameter descriptions (edge-sets pairs, use-edge-location, multiple overrides), fixes typos ('routing poliy' -> 'routing policy', 'set-local-prefrence' -> 'set-local-preference'), and adds a full JSON example showing correct ordering of a non-terminal set-local-preference rule followed by terminal allow and drop rules in an outbound routing policy.

Security assessment

The added example demonstrates routing policy rule ordering where a terminal drop rule with 0.0.0.0/0 filters remaining traffic; this is traffic-path guidance rather than documentation of a vulnerability or security control, and the rest of the change is wording/typo fixes and edge-override clarification.

Evidence

+          "action": {
+                  "type": "drop"

Diff

diff --git a/network-manager/latest/cloudwan/cloudwan-policies-json.md b/network-manager/latest/cloudwan/cloudwan-policies-json.md
index f89542f46..ab7b1c18a 100644
--- a//network-manager/latest/cloudwan/cloudwan-policies-json.md
+++ b//network-manager/latest/cloudwan/cloudwan-policies-json.md
@@ -302 +302 @@ The following are the required and optional parameters:
-      * `with-edge-overrides` parameters describe any edge overrides and the preferred edge to use.
+      * `with-edge-overrides` parameters describe the edge location pairs that traffic flows between and the preferred edge location to use for each pair. You can define multiple overrides. Each override has its own edge set and its own preferred edge location.
@@ -304 +304 @@ The following are the required and optional parameters:
-        * `edge-sets` — The list of edges associated with the network function group.
+        * `edge-sets` — Defines the edge location pairs that this override applies to. Each entry is a list of edge locations. An entry with two edge locations matches traffic between those two edge locations in either direction. An entry with three or more edge locations matches traffic between any combination of two edge locations in the set.
@@ -306 +306 @@ The following are the required and optional parameters:
-        * `use-edge-location` — The preferred edge to use.
+        * `use-edge-location` — The preferred edge location for traffic that flows between the edge locations in `edge-sets`. When the network function group has attachments in both edge locations of a matched pair, Cloud WAN steers traffic to the edge location that you specify here. If you don't set an edge override, Cloud WAN uses the default priority list to select the edge location instead. For more information, see [AWS Cloud WAN service insertion.](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-policy-service-insertion.html)
@@ -582 +582 @@ The following parameters are used in `routing-policies`:
-drop and allow result in terminal states, this means if a route matches a policy with a drop/allow action then no other routing poliy rules after that rule will be evaluated. For example, if you have a routing policy with the following rules: 
+drop and allow result in terminal states, this means if a route matches a policy with a drop/allow action then no other routing policy rules after that rule will be evaluated. For example, if you have a routing policy with the following rules: 
@@ -588 +588 @@ drop and allow result in terminal states, this means if a route matches a policy
-          * Rule 3: set-local-prefrence, prefix-in-cidr 10.0.0.0/8
+          * Rule 3: set-local-preference, prefix-in-cidr 10.0.0.0/8
@@ -592 +592 @@ The rule 1 drop rule would be terminal meaning all routes would be dropped and r
-          * Rule 1: set-local-prefrence, prefix-in-cidr 10.0.0.0/8
+          * Rule 1: set-local-preference, prefix-in-cidr 10.0.0.0/8
@@ -674,0 +675,62 @@ The following example shows two inbound routing policies: `RP1` is a routing pol
+The following example shows correct rule ordering when combining non-terminal and terminal actions in an outbound routing policy. Rule 10 sets local preference (non-terminal). Rule 20 allows the matched routes (terminal). Rule 30 drops everything else (terminal).
+    
+    
+    {
+      "routing-policies": [
+        {
+          "routing-policy-name": "outboundWithLocalPref",
+          "routing-policy-description": "Set local preference then allow, with default drop",
+          "routing-policy-direction": "outbound",
+          "routing-policy-number": 50,
+          "routing-policy-rules": [
+            {
+              "rule-number": 10,
+              "rule-definition": {
+                "match-conditions": [
+                  {
+                    "type": "prefix-in-cidr",
+                    "value": "10.0.0.0/8"
+                  }
+                ],
+                "condition-logic": "and",
+                "action": {
+                  "type": "set-local-preference",
+                  "value": 200
+                }
+              }
+            },
+            {
+              "rule-number": 20,
+              "rule-definition": {
+                "match-conditions": [
+                  {
+                    "type": "prefix-in-cidr",
+                    "value": "10.0.0.0/8"
+                  }
+                ],
+                "condition-logic": "and",
+                "action": {
+                  "type": "allow"
+                }
+              }
+            },
+            {
+              "rule-number": 30,
+              "rule-definition": {
+                "match-conditions": [
+                  {
+                    "type": "prefix-in-cidr",
+                    "value": "0.0.0.0/0"
+                  }
+                ],
+                "condition-logic": "and",
+                "action": {
+                  "type": "drop"
+                }
+              }
+            }
+          ]
+        }
+      ]
+    }
+