AWS vpc: Add CIDR resource configuration and tunnel endpoint docs
Summary
Adds documentation for CIDR resource configurations (a list of CIDR ranges shared to consumer accounts), including the CIDR-reaching requirement, the 0.0.0.0/0 / ::/0 option for full network access, and the TCP_UDP protocol requirement. Also documents that CIDR resource configurations cannot be associated with a service network and are reachable only via AWS PrivateLink tunnel endpoints, and rewords existing notes on custom domain verification, private DNS, and preventing transitive resource sharing via AWS RAM/service networks.
Security assessment
The change is primarily feature documentation for a new CIDR-based resource configuration type and its delivery through tunnel endpoints, with no reference to a CVE, incident, or patched vulnerability. It does carry security-adjacent operational guidance: consumers only reach CIDRs that are reachable from the resource gateway, an overly broad prefix like 0.0.0.0/0 exposes the full network range, and CIDR configurations cannot be placed in service networks; the reworded notes on custom domain verification, private DNS precedence, and disallowing transitive sharing across accounts remain best-practice guidance rather than a fix.
Evidence
+ * By a **CIDR range** : For a resource configuration of type CIDR, specify the list of CIDRs you want to share (for example, 10.0.0.0/24). The CIDRs should be reachable from the resource gateway. To provide full network access, specify 0.0.0.0/0 if using IPv4 or ::/0 if using IPv6.
Diff
diff --git a/vpc/latest/privatelink/resource-configuration.md b/vpc/latest/privatelink/resource-configuration.md index 337e67296..b044caea0 100644 --- a//vpc/latest/privatelink/resource-configuration.md +++ b//vpc/latest/privatelink/resource-configuration.md @@ -11 +11 @@ Types of resource configurationsResource gatewayCustom domain names for resource -A resource configuration represents a resource or a group of resources that you want to make accessible to clients in other VPCs and accounts. By defining a resource configuration, you can allow private, secure, unidirectional network connectivity to resources in your VPC from clients in other VPCs and accounts. A resource configuration is associated with a resource gateway through which it receives traffic. +A resource configuration represents an individual resource, a group of resources, or a list of CIDR ranges that you want to make accessible to clients in other VPCs and accounts. By defining a resource configuration, you can allow private, secure, unidirectional network connectivity to resources in your VPC from clients in other VPCs and accounts. A resource configuration is associated with a resource gateway through which it receives traffic. @@ -56 +56 @@ A resource configuration can be of several types. The different types help repre - * **Child resource configuration** : A member of a Group resource configuration. It represents an IP address or a domain name. It can’t be shared independently; and can only be shared as part of a group. It can be added and removed from a group seamlessly. When added, its automatically accessible to those who can access the group. + * **Child resource configuration** : A member of a Group resource configuration. It represents an IP address or a domain name. It can't be shared independently, and can only be shared as part of a group. It can be added and removed from a group seamlessly. When added, it's automatically accessible to those who can access the group. @@ -58 +58,3 @@ A resource configuration can be of several types. The different types help repre - * **ARN resource configuration** : Represents a supported resource-type that is provisioned by an AWS service. For example, an Amazon RDS database. Child resource configurations are automatically managed by AWS. + * **ARN resource configuration** : A supported resource type that is provisioned by an AWS service. For example, an Amazon RDS database. Child resource configurations are automatically managed by AWS. It can be shared independently. + + * **CIDR resource configuration** : A list of CIDR ranges. It can be shared independently. @@ -79 +81,3 @@ The following considerations apply to providers of resource configurations: - * You can verify your custom domain name using the domain name verification process in VPC Lattice. For more information For more information, see <https://docs.aws.amazon.com/vpc-lattice/latest/ug/create-and-verify.html>. + * You can verify your custom domain name using the domain name verification process in VPC Lattice. For more information, see <https://docs.aws.amazon.com/vpc-lattice/latest/ug/create-and-verify.html>. + + * For resource configurations of type group and child, you must first specify a group domain on the group resource configuration. Afterward, the child resource configurations can have custom domains that are subdomains of the group domain. If the group doesn't have a group domain, you can use any custom domain name for the child, but VPC Lattice will not provision any hosted zones for the child domain names in the resource consumer's VPC. @@ -81 +85 @@ The following considerations apply to providers of resource configurations: - * For resource configurations of type group and child, you must first specify a group domain on the group resource configuration. After, the child resource configurations can have custom domains that are subdomains of the group domain. If the group doesn’t have a group domain, you can use any custom domain name for the child, but VPC Lattice will not provision any hosted zones for the child domain names in the resource consumer’s VPC. + * Custom domain names are not supported for CIDR resource configurations. @@ -100 +104 @@ VPC Lattice provisions private hosted zones for all custom domain names. -VPC Lattice provisions a private hosted zone only if custom domain name has been verified by the provider. +VPC Lattice provisions a private hosted zone only if the custom domain name has been verified by the provider. @@ -122 +126 @@ The following considerations apply to consumers of resource configurations: - * Private DNS should be enabled on a service network resource association for private hosted to be created in a VPC. For a resource configuration, the private DNS enabled status of the service network resource association overrides the private DNS enabled status of either the service network endpoint or service network VPC association. + * Private DNS should be enabled on a service network resource association for private hosted zones to be created in a VPC. For a resource configuration, the private DNS enabled status of the service network resource association overrides the private DNS enabled status of either the service network endpoint or service network VPC association. @@ -149 +153 @@ The private DNS enabled property of the service network resource association ove -If a service network owner creates a service network resource association and doesn't enable private DNS, VPC Lattice won’t provision private hosted zones for that resource configuration in any VPCs that the service network is connected to, even though private DNS is enabled on the service network endpoint or service network VPC associations. +If a service network owner creates a service network resource association and doesn't enable private DNS, VPC Lattice won't provision private hosted zones for that resource configuration in any VPCs that the service network is connected to, even though private DNS is enabled on the service network endpoint or service network VPC associations. @@ -157 +161 @@ In the resource configuration, identify the resource in one of the following way - * By an **Amazon Resource Name (ARN)** : Supported resource-types that are provisioned by AWS services, can be identified by their ARN. Only Amazon RDS databases are supported. You can't create a resource configuration for a publicly accessible cluster. + * By an **Amazon Resource Name (ARN)** : Supported resource types that are provisioned by AWS services can be identified by their ARN. Only Amazon RDS databases are supported. You can't create a resource configuration for a publicly accessible cluster. @@ -161 +165,3 @@ In the resource configuration, identify the resource in one of the following way - * By an **IP-address** : For IPv4, specify a private IP from the following ranges: 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16. For IPv6, specify an IP from the VPC. Public IPs aren't supported. + * By an **IP address** : For IPv4, specify a private IP from the following ranges: 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16. For IPv6, specify an IP from the VPC. Public IPs aren't supported. + + * By a **CIDR range** : For a resource configuration of type CIDR, specify the list of CIDRs you want to share (for example, 10.0.0.0/24). The CIDRs should be reachable from the resource gateway. To provide full network access, specify 0.0.0.0/0 if using IPv4 or ::/0 if using IPv6. @@ -169,0 +176,2 @@ When you create a resource configuration you can define the protocols that the r +For CIDR resource configurations, the protocol has to be `TCP_UDP`: only TCP is supported for application traffic, UDP is supported only for DNS queries. + @@ -180 +188 @@ Consumers can access resource configurations directly from their VPC using a VPC -You can create a AWS PrivateLink VPC endpoint of type resource (resource endpoint) in your VPC to access a resource configuration privately from your VPC. For more information on how to create a resource endpoint, see [Accessing VPC resources](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-resources.html) in the _AWS PrivateLinkuser guide_. +You can access resource configurations directly through AWS PrivateLink-based resource endpoints and tunnel endpoints. You can create a resource endpoint in your VPC to access resource configurations of types ARN, Single, and Group, and can create a tunnel endpoint to access resource configurations of type CIDR. For more information on how to create resource and tunnel endpoints, see [Accessing VPC resources](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-resources.html) and [Accessing network segments](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-cidr-ranges.html) in the _AWS PrivateLink user guide_. @@ -184 +192 @@ You can create a AWS PrivateLink VPC endpoint of type resource (resource endpoin -You can associate a resource configuration to a service network, and connect your VPC to the service network. You can connect your VPC to the service network either through an association or using a AWS PrivateLink service-network VPC endpoint. +You can associate a resource configuration with a service network, and connect your VPC to the service network. You can connect your VPC to the service network either through an association or using a AWS PrivateLink-based service network endpoint. CIDR resource configurations cannot be associated with a service network. @@ -193 +201 @@ For more information on service network VPC endpoints, see [Access service netwo -When private DNS is enabled for your VPC, you can’t create a resource endpoint and service network endpoint for the same resource configuration. +When private DNS is enabled for your VPC, you can't create a resource endpoint and service network endpoint for the same resource configuration. @@ -197 +205 @@ When private DNS is enabled for your VPC, you can’t create a resource endpoint -When you share a resource configuration with a consumer account, for example, Account-B, through AWS RAM, Account-B can access the resource configuration either directly through a resource VPC endpoint, or through a service network. +When you share a resource configuration with a consumer account, for example, Account-B, through AWS RAM, Account-B can access the resource configuration either directly through a resource endpoint or tunnel endpoint, or through a service network. CIDR resource configurations cannot be accessed through a service network. They can only be accessed directly through a tunnel endpoint. @@ -201 +209 @@ To access a resource configuration through a service network, Account-B would ha -In order to prevent such transitive sharing, you can specify that your resource configuration cannot be added to service networks that are shareable between accounts. If you specify this, then Account-B won’t be able to add your resource configuration to service networks that are shared or can be shared with another account in the future. +To prevent such transitive sharing, you can specify that your resource configuration cannot be added to service networks that are shareable between accounts. If you specify this, then Account-B won't be able to add your resource configuration to service networks that are shared or can be shared with another account in the future. @@ -205 +213 @@ In order to prevent such transitive sharing, you can specify that your resource -When you share a resource configuration with another account, for example Account-B, through AWS RAM, Account-B can access the resource in one of three ways: +When you share a resource configuration with another account, for example Account-B, through AWS RAM, Account-B can access the resource in one of four ways: @@ -207 +215 @@ When you share a resource configuration with another account, for example Accoun - * Using a VPC endpoint of type _resource_ (resource VPC endpoint). + * Using a AWS PrivateLink-based resource endpoint (for Single, Group, and ARN resource configurations). @@ -209 +217,3 @@ When you share a resource configuration with another account, for example Accoun - * Using a VPC endpoint of type _service network_ (service network VPC endpoint). + * Using a AWS PrivateLink-based tunnel endpoint (for CIDR resource configurations). + + * Using a AWS PrivateLink-based service network endpoint. @@ -213 +222,0 @@ When you share a resource configuration with another account, for example Accoun -When you use a service-network association, each resource is assigned an IP per subnet from the 129.224.0.0/17 block, which is AWS owned and non-routable. This is in addition to the [managed prefix list](https://docs.aws.amazon.com/vpc-lattice/latest/ug/security-groups.html#managed-prefix-list) that VPC Lattice uses to route traffic to services over the VPC Lattice network. Both of these IPs are updated to your VPC route table. @@ -216,0 +226 @@ When you use a service-network association, each resource is assigned an IP per +When you use a service-network association, each resource is assigned an IP per subnet from the 129.224.0.0/17 block, which is AWS owned and non-routable. This is in addition to the [managed prefix list](https://docs.aws.amazon.com/vpc-lattice/latest/ug/security-groups.html#managed-prefix-list) that VPC Lattice uses to route traffic to services over the VPC Lattice network. Both of these IPs are updated to your VPC route table. @@ -218 +228 @@ When you use a service-network association, each resource is assigned an IP per -For service network VPC endpoint and service network VPC association, the resource configuration would have to be put in a service network in Account-B. Service networks are shareable between accounts. So, Account-B can share their service network (that contains the resource configuration) with Account-C, making your resource accessible from Account-C. In order to prevent such transitive sharing, you can disallow your resource configuration from being added to service networks that are shareable between accounts. If you disallow this, then Account-B won’t be able to add your resource configuration to a service network that is shared or can be shared with another account. +For service network endpoint and service network VPC association, the resource configuration would have to be put in a service network in Account-B. Service networks are shareable between accounts. So, Account-B can share their service network (that contains the resource configuration) with Account-C, making your resource accessible from Account-C. To prevent such transitive sharing, you can disallow your resource configuration from being added to service networks that are shareable between accounts. If you disallow this, then Account-B won't be able to add your resource configuration to a service network that is shared or can be shared with another account. @@ -226 +236 @@ Use the AWS RAM console, to view the resource shares to which you have been adde -To access a resource from another VPC in the same account as the resource configuration, you don’t need to share the resource configuration through AWS RAM. +To access a resource from another VPC in the same account as the resource configuration, you don't need to share the resource configuration through AWS RAM. @@ -238 +248 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Manage resource endpoints +Manage service-network endpoints