AWS vpc: PrivateLink concepts: network-segment resource configurations and tunnel endpoints
Summary
Broadens the definition of a resource configuration to include a segment of a network (a set of CIDR ranges) and documents a new 'Tunnel' VPC endpoint type that privately tunnels into a shared network segment using GENEVE encapsulation.
Security assessment
The change documents a new private-connectivity capability (tunnel endpoints over GENEVE) whose stated purpose is private, secure access to a shared network segment, i.e., avoiding public exposure of resources; however it is feature/concept documentation with no reference to a specific vulnerability, CVE, or credential/authorization control.
Evidence
+ * `Tunnel` \- Create a _tunnel endpoint_ to access a network segment that was shared with you from another VPC or account. A tunnel endpoint lets you privately and securely tunnel into a network segment (a list of CIDR ranges) and access any resource located in the segment. Tunnel endpoints require you to encapsulate application traffic in GENEVE.
Diff
diff --git a/vpc/latest/privatelink/concepts.md b/vpc/latest/privatelink/concepts.md index 542525bd0..90f3470a0 100644 --- a//vpc/latest/privatelink/concepts.md +++ b//vpc/latest/privatelink/concepts.md @@ -92 +92 @@ The following are the possible states for an endpoint service: -The resource provider creates a _resource configuration_ to share a resource. A resource configuration is a logical object that represents either a single resource such as a database, or a group of resources. A resource can be an IP address, a domain-name target, or an [Amazon Relational Database Service](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html) (Amazon RDS) database. +The resource provider creates a _resource configuration_ to share a resource. A resource configuration is a logical object that represents a single resource such as a database, a group of resources, or a segment of a network (a set of CIDR ranges). A resource can be an IP address, a domain-name target, or an [Amazon Relational Database Service](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html) (Amazon RDS) database. @@ -128,0 +129,2 @@ A consumer creates a _VPC endpoint_ to connect their VPC to an endpoint service + * `Tunnel` \- Create a _tunnel endpoint_ to access a network segment that was shared with you from another VPC or account. A tunnel endpoint lets you privately and securely tunnel into a network segment (a list of CIDR ranges) and access any resource located in the segment. Tunnel endpoints require you to encapsulate application traffic in GENEVE. +