AWS vpc: Clarify DNS resolution constraints for tunnel endpoint 169.254.168.253
Summary
Renames the 'Contents' heading to 'Topics' and adds a note that DNS queries sent to 169.254.168.253 are subject to the IN_VPC DNS resolution constraints of the resource gateway, with a link to the resource gateway DNS resolution flags documentation.
Security assessment
The added line is a functional clarification of how DNS resolution behaves for the PrivateLink tunnel endpoint address; it explains resolution scope rather than documenting a security control, hardening step, or a fixed vulnerability. Security relevance is tangential (DNS behavior), so severity is low.
Evidence
+DNS queries sent to `169.254.168.253` are subject to the `IN_VPC` DNS resolution constraints of the resource gateway. For more information about DNS resolution flags, see [Resource Config DNS Resolution](./resource-gateway.html#resource-config-dns-resolution).
Diff
diff --git a/vpc/latest/privatelink/privatelink-access-cidr-ranges.md b/vpc/latest/privatelink/privatelink-access-cidr-ranges.md index 9842dca..48940c0 100644 --- a//vpc/latest/privatelink/privatelink-access-cidr-ranges.md +++ b//vpc/latest/privatelink/privatelink-access-cidr-ranges.md @@ -17 +17 @@ When you access a network segment using a tunnel endpoint, you are billed for ea -###### Contents +###### Topics @@ -62,0 +63,2 @@ A tunnel endpoint lets you resolve DNS in the context of the VPC that is sharing +DNS queries sent to `169.254.168.253` are subject to the `IN_VPC` DNS resolution constraints of the resource gateway. For more information about DNS resolution flags, see [Resource Config DNS Resolution](./resource-gateway.html#resource-config-dns-resolution). +