AWS vpc: Warn that VXLAN VNI is not a trust boundary in Traffic Mirroring
Summary
Adds an Important note stating the VXLAN network identifier (VNI) is caller-chosen, unvalidated, unauthenticated, and not unique across accounts sharing a mirror target, so it must not be treated as a trust boundary.
Security assessment
The note explicitly warns that VNI values are unauthenticated and non-unique across accounts, advising users not to rely on them as a trust boundary. This is security guidance about a spoofing/trust-boundary risk in Traffic Mirroring, though it documents a design property rather than fixing a specific vulnerability.
Evidence
+The VXLAN network identifier (VNI) is a caller-chosen label that AWS does not validate or authenticate. VNI values are not guaranteed to be unique across sessions from different accounts that share the same traffic mirror target. Do not treat the VNI as a trust boundary.
Diff
diff --git a/vpc/latest/mirroring/traffic-mirroring-packet-formats.md b/vpc/latest/mirroring/traffic-mirroring-packet-formats.md index e3bba54..13f72b2 100644 --- a//vpc/latest/mirroring/traffic-mirroring-packet-formats.md +++ b//vpc/latest/mirroring/traffic-mirroring-packet-formats.md @@ -18,0 +19,4 @@ The following fields apply to Traffic Mirroring: +###### Important + +The VXLAN network identifier (VNI) is a caller-chosen label that AWS does not validate or authenticate. VNI values are not guaranteed to be unique across sessions from different accounts that share the same traffic mirror target. Do not treat the VNI as a trust boundary. +