AWS network-manager: Document Cloud WAN network function groups for security service insertion
Summary
Adds a bullet describing network function groups: global constructs holding core network attachments that host network or security functions such as firewalls and IDPS, provisioned as a managed Cloud WAN segment with fully managed routing and automatic intra-/inter-Region traffic steering. Also adds a note explaining that the Region order in the supported-Regions table serves as the default priority list for AWS Cloud WAN service insertion, unless overridden with `with-edge-overrides` in segment-actions.
Security assessment
The change documents a service-insertion feature that routes traffic through customer security appliances (firewalls, IDPS), which is security-relevant architecture and inspection guidance, but it describes a capability rather than fixing a vulnerability or incident. No CVE, credential, or IAM change is referenced, so severity is moderate hardening/design guidance.
Evidence
A network function group is a global construct. It contains core network attachments that host network or security functions, such as firewalls or intrusion detection and prevention systems (IDPS). A network function group is provisioned as a managed Cloud WAN segment. However, routing is fully managed, and no static routes are required. You define the segments or segment pairs in your core network policy whose traffic should be redirected. Cloud WAN then automatically steers both intra-Region and inter-Region traffic through the associated network function group attachments.
Diff
diff --git a/network-manager/latest/cloudwan/what-is-cloudwan.md b/network-manager/latest/cloudwan/what-is-cloudwan.md index ffc76f9bd..7b8f8441c 100644 --- a//network-manager/latest/cloudwan/what-is-cloudwan.md +++ b//network-manager/latest/cloudwan/what-is-cloudwan.md @@ -73,0 +74,4 @@ You can create a segment and define whether resources that ask for access requir + * **Network function group** + +A network function group is a global construct. It contains core network attachments that host network or security functions, such as firewalls or intrusion detection and prevention systems (IDPS). A network function group is provisioned as a managed Cloud WAN segment. However, routing is fully managed, and no static routes are required. You define the segments or segment pairs in your core network policy whose traffic should be redirected. Cloud WAN then automatically steers both intra-Region and inter-Region traffic through the associated network function group attachments. + @@ -210,0 +215,4 @@ me-south-1 | Middle East (Bahrain) +###### Note + +The order of Regions in this table is also used as the default priority list for [AWS Cloud WAN service insertion](./cloudwan-policy-service-insertion.html). When Cloud WAN selects between multiple Regions for network function group traffic steering, it uses this order by default. If you haven't configured an explicit preference using `with-edge-overrides` in [segment-actions](./cloudwan-policies-json.html#cloudwan-segment-actions-json), Cloud WAN selects the Region that appears first in the list. +