AWS vpc: Clarify shared-subnet resource gateway permissions and quota
Summary
Updates resource gateway considerations: participant accounts with shared subnets can now create resource gateways, quota is counted against the VPC owner, and resource configurations can only be created by the resource gateway owner.
Security assessment
The edit documents who is authorized to create resource gateways in shared VPC subnets and who may create resource configurations, which is permission-model guidance with security impact (shared-subnet resource creation by participant accounts). It is a documentation clarification, not a fix for a specific vulnerability.
Evidence
+ * The VPC owner, or a participant account that a subnet is shared with, can create a resource gateway in a shared VPC subnet.
Diff
diff --git a/vpc/latest/privatelink/resource-gateway.md b/vpc/latest/privatelink/resource-gateway.md index e723555..e6454c8 100644 --- a//vpc/latest/privatelink/resource-gateway.md +++ b//vpc/latest/privatelink/resource-gateway.md @@ -44 +44 @@ The following considerations apply to resource gateways: - * A VPC can have a maximum of 100 resource gateways. For more information, see [Quotas for VPC Lattice](https://docs.aws.amazon.com/vpc-lattice/latest/ug/quotas.html). + * A VPC can have a maximum of 100 resource gateways. For more information, see [Quotas for VPC Lattice](https://docs.aws.amazon.com/vpc-lattice/latest/ug/quotas.html). This quota counts against the VPC owner account and includes the resource gateways that participant accounts create in the shared subnets of that VPC. @@ -46 +46,3 @@ The following considerations apply to resource gateways: - * You can't create a resource gateway in a shared subnet. + * The VPC owner, or a participant account that a subnet is shared with, can create a resource gateway in a shared VPC subnet. + + * You can create a resource configuration for a resource gateway only from the account that owns the resource gateway.