AWS network-manager: Document NAT configuration change events in EventBridge
Summary
Adds a paragraph describing that 1:1 NAT lifecycle changes emit Amazon EventBridge events (change type ATTACHMENT_NAT_CONFIGURATION_UPDATED, source aws.networkmanager, detail-type 'Network Manager Topology Change') carrying attachment ARN, edge location, core network ARN, and current/previous values of natGatewaySupport, natSystemRouteSupport, and natGatewayRules.
Security assessment
The added text documents an audit/monitoring capability: EventBridge events that record before/after values for NAT gateway support, system routes, and NAT rules, enabling detection of unauthorized or unexpected network configuration changes. It is feature documentation with security-adjacent (logging/audit) value rather than a fix for a specific weakness.
Evidence
+1:1 network address translation (NAT) lifecycle changes emit events through Amazon EventBridge. You can use these events to trigger automation or track configuration changes. A single event is emitted for each completed NAT configuration change, matching a single `UpdateAttachmentNatConfiguration` call. The change type is `ATTACHMENT_NAT_CONFIGURATION_UPDATED`. Events use source `aws.networkmanager` and detail-type is `TOPOLOGY_CHANGE = "Network Manager Topology Change"`. Each event carries the attachment ARN, edge location, core network ARN, and both the current and previous values of `natGatewaySupport`, `natSystemRouteSupport`, and `natGatewayRules`, so you can determine exactly what changed.
Diff
diff --git a/network-manager/latest/cloudwan/cloudwan-cloudwatch-events.md b/network-manager/latest/cloudwan/cloudwan-cloudwatch-events.md index 4dd1cf3..bfd1165 100644 --- a//network-manager/latest/cloudwan/cloudwan-cloudwatch-events.md +++ b//network-manager/latest/cloudwan/cloudwan-cloudwatch-events.md @@ -66,0 +67,2 @@ Topology change events occur when there are changes to your core network resourc +1:1 network address translation (NAT) lifecycle changes emit events through Amazon EventBridge. You can use these events to trigger automation or track configuration changes. A single event is emitted for each completed NAT configuration change, matching a single `UpdateAttachmentNatConfiguration` call. The change type is `ATTACHMENT_NAT_CONFIGURATION_UPDATED`. Events use source `aws.networkmanager` and detail-type is `TOPOLOGY_CHANGE = "Network Manager Topology Change"`. Each event carries the attachment ARN, edge location, core network ARN, and both the current and previous values of `natGatewaySupport`, `natSystemRouteSupport`, and `natGatewayRules`, so you can determine exactly what changed. +