AWS vpc: Resource gateway doc: grammar fixes and DNS/CIDR clarification
Summary
Copy-editing of the resource gateway page (hyphenation, comma usage, wording) plus one substantive clarification that DNS resolution must be IN_VPC to attach CIDR resource configurations to the resource gateway.
Security assessment
The change is predominantly editorial (e.g., 'IPv6 only' to 'IPv6-only', 'does DNS resolution' to 'performs DNS resolution'). The only functional addition clarifies a configuration constraint (IN_VPC DNS resolution required for CIDR resource configurations), which is a usability/behavior note rather than a security control or vulnerability fix.
Evidence
+If DNS resolution is IN_VPC, you cannot attach resource configurations defined by ARN to the resource gateway. You cannot set DNS resolution to IN_VPC if the resource gateway uses IPv6-only subnets. DNS resolution has to be IN_VPC to attach CIDR resource configurations to the resource gateway.
Diff
diff --git a/vpc/latest/privatelink/resource-gateway.md b/vpc/latest/privatelink/resource-gateway.md index 30f739472..2b1a4586b 100644 --- a//vpc/latest/privatelink/resource-gateway.md +++ b//vpc/latest/privatelink/resource-gateway.md @@ -13 +13 @@ A resource gateway is a point of inbound traffic into the VPC where a resource r -A VPC must have a resource gateway if you plan on making resources inside the VPC accessible from other VPCs or accounts. Every resource you share is associated with a resource gateway. When clients in other VPCs or accounts access a resource in your VPC, the resource sees traffic coming locally from the resource gateway in that VPC. The source IP of the traffic is the IP address of the resource gateway. You can assign multiple IP addresses to a resource gateway to allow for more network connections with the resource. Multiple resources in a VPC can be associated with the same resource gateway. +A VPC must have a resource gateway if you plan to make resources inside the VPC accessible from other VPCs or accounts. Every resource you share is associated with a resource gateway. When clients in other VPCs or accounts access a resource in your VPC, the resource sees traffic coming locally from the resource gateway in that VPC. The source IP of the traffic is the IP address of the resource gateway. You can assign multiple IP addresses to a resource gateway to allow for more network connections with the resource. Multiple resources in a VPC can be associated with the same resource gateway. @@ -65 +65 @@ Destination | Protocol | Port range | Comment -A resource gateway can have IPv4, IPv6 or dual-stack addresses. The IP address type of a resource gateway must be compatible with the subnets of the resource gateway and the IP address type of the resource, as described here: +A resource gateway can have IPv4, IPv6, or dual-stack addresses. The IP address type of a resource gateway must be compatible with the subnets of the resource gateway and the IP address type of the resource, as described here: @@ -69 +69 @@ A resource gateway can have IPv4, IPv6 or dual-stack addresses. The IP address t - * **IPv6** – Assign IPv6 addresses to your gateway network interfaces. This option is supported only if all selected subnets are IPv6 only subnets, and the resource also has an IPv6 address. + * **IPv6** – Assign IPv6 addresses to your gateway network interfaces. This option is supported only if all selected subnets are IPv6-only subnets, and the resource also has an IPv6 address. @@ -71 +71 @@ A resource gateway can have IPv4, IPv6 or dual-stack addresses. The IP address t - * **Dualstack** – Assign both IPv4 and IPv6 addresses to your gateway network interfaces. This option is supported only if all selected subnets have both IPv4 and IPv6 address ranges, and the resource either has an IPv4 or IPv6 address. + * **Dualstack** – Assign both IPv4 and IPv6 addresses to your gateway network interfaces. This option is supported only if all selected subnets have both IPv4 and IPv6 address ranges, and the resource either has an IPv4 or an IPv6 address. @@ -80 +80 @@ The IP address type of the resource gateway is independent of the IP address typ -If your resource gateway has an IPv4 or a dual-stack IP address type, you can configure the number of IPv4 addresses assigned to each ENI of your resource gateway. When you create a resource gateway, you choose from 1 to 62 IPv4 addresses. Once you set the number of IPv4 addresses, the value can't be changed. +If your resource gateway has an IPv4 or a dual-stack IP address type, you can configure the number of IPv4 addresses assigned to each ENI of your resource gateway. When you create a resource gateway, you choose from 1 to 62 IPv4 addresses. After you set the number of IPv4 addresses, the value can't be changed. @@ -88 +88 @@ If your resource gateway uses the IPv6 address type, the resource gateway automa -You can specify how a resource gateway does DNS resolution for resource configurations that are domain-name targets. This property is immutable. You can choose: +You can specify how a resource gateway performs DNS resolution for resource configurations that are domain-name targets. This property is immutable. You can choose: @@ -97 +97 @@ You can specify how a resource gateway does DNS resolution for resource configur -If DNS resolution is IN_VPC, you cannot attach resource configurations defined by ARN to the resource gateway. You cannot set DNS Resolution to IN_VPC if the resource gateway uses IPv6-only subnets. +If DNS resolution is IN_VPC, you cannot attach resource configurations defined by ARN to the resource gateway. You cannot set DNS resolution to IN_VPC if the resource gateway uses IPv6-only subnets. DNS resolution has to be IN_VPC to attach CIDR resource configurations to the resource gateway.