AWS network-manager: Document Cloud WAN Region selection and with-edge-overrides for service insertion
Summary
Rewrites the paragraph explaining how Cloud WAN selects a Region/edge for service insertion (e.g., steering traffic to an Inspection VPC), noting the default Region priority list behavior and how `with-edge-overrides` in a segment action can override it with multiple Region-pair/preferred-edge overrides.
Security assessment
The change clarifies how inspection-VPC (security appliance) traffic steering selects a Region and how overrides are configured; it refines existing operational guidance rather than introducing a new security feature or addressing a specific vulnerability.
Evidence
+By default, Cloud WAN selects an attachment in one of the two Regions used for the network function. For example, if the network function is steering traffic to an Inspection VPC, and that Inspection VPC exists in only one Region, Cloud WAN uses the Region where the Inspection VPC resides to steer all cross-Region traffic. If the Inspection VPC exists in both Regions, service insertion deterministically chooses which Region to use. This choice is based on the default Region priority list. You can override this default selection using `with-edge-overrides` in your segment action. Each override specifies a set of Region pairs and a preferred edge location. You can define multiple overrides per segment action, each covering different Region pairs with different preferred edges. For more information, see the `with-edge-overrides` parameters in [segment-actions](./cloudwan-policies-json.html#cloudwan-segment-actions-json).
Diff
diff --git a/network-manager/latest/cloudwan/cloudwan-policy-service-insertion.md b/network-manager/latest/cloudwan/cloudwan-policy-service-insertion.md index 501583fab..45b3be357 100644 --- a//network-manager/latest/cloudwan/cloudwan-policy-service-insertion.md +++ b//network-manager/latest/cloudwan/cloudwan-policy-service-insertion.md @@ -39 +39 @@ For the service insertion action, you can create a send via action which sends t -By default, Cloud WAN will select an attachment in one of the two Regions used for the network function. For example, if the network function is steering traffic to an Inspection VPC, and that Inspection VPC exists in only one Region, Cloud WAN uses the Region where the Inspection VPC resides to steer all cross-Region traffic. If the Inspection VPC exists in both Regions, service insertion will deterministically choose which Region to use based on the [default Region priority list](what-is-cloudwan.html#cloudwan-available-regions). However, when setting the segment actions, you can choose the Region priority order as well as choose the preferred Region to use. If the Inspection VPC doesn't exist in either Region, Cloud WAN uses the fallback Region specified in the segment policy. You can only specific a single fallback Region per segment policy. +By default, Cloud WAN selects an attachment in one of the two Regions used for the network function. For example, if the network function is steering traffic to an Inspection VPC, and that Inspection VPC exists in only one Region, Cloud WAN uses the Region where the Inspection VPC resides to steer all cross-Region traffic. If the Inspection VPC exists in both Regions, service insertion deterministically chooses which Region to use. This choice is based on the default Region priority list. You can override this default selection using `with-edge-overrides` in your segment action. Each override specifies a set of Region pairs and a preferred edge location. You can define multiple overrides per segment action, each covering different Region pairs with different preferred edges. For more information, see the `with-edge-overrides` parameters in [segment-actions](./cloudwan-policies-json.html#cloudwan-segment-actions-json).