AWS vpc: Resource gateway quota raised to 500; shared VPC subnet rules documented
Summary
Updates the resource gateway quota from 100 to a default of 500 (adjustable) and adds a new set of considerations for resource gateways created by participant accounts in shared VPC subnets: security group ownership requirements, restrictions on IP/CIDR targets to shared subnets, RDS-by-ARN must be in the gateway owner's account, and domain-name targets bypassing subnet range checks.
Security assessment
The added text documents security-relevant guardrails for cross-account shared subnets: participant accounts must own the security groups they attach (no default or shared SGs), and IP/CIDR targets are confined to subnets shared with that account, preventing lateral reach into on-premises, peered VPCs, or unshared subnets. It also notes domain-name targets are not subject to the subnet range check, which is a boundary caveat worth understanding. No specific vulnerability, CVE, or incident is referenced, so this is hardening guidance rather than a fix.
Evidence
+ * A participant account must specify at least one security group for its resource gateway, and must own every security group that it specifies. A participant account can't use the VPC's default security group or security groups that are shared with it. Specifying one of these returns a "cannot be found" error.
Diff
diff --git a/vpc/latest/privatelink/resource-gateway.md b/vpc/latest/privatelink/resource-gateway.md index e6454c8..faa296f 100644 --- a//vpc/latest/privatelink/resource-gateway.md +++ b//vpc/latest/privatelink/resource-gateway.md @@ -44 +44,3 @@ The following considerations apply to resource gateways: - * A VPC can have a maximum of 100 resource gateways. For more information, see [Quotas for VPC Lattice](https://docs.aws.amazon.com/vpc-lattice/latest/ug/quotas.html). This quota counts against the VPC owner account and includes the resource gateways that participant accounts create in the shared subnets of that VPC. + * A VPC has a default quota of 500 resource gateways, which is adjustable. For more information, see [Quotas for VPC Lattice](https://docs.aws.amazon.com/vpc-lattice/latest/ug/quotas.html). + + * The following considerations apply to resource gateways with shared VPC subnets: @@ -48 +50,13 @@ The following considerations apply to resource gateways: - * You can create a resource configuration for a resource gateway only from the account that owns the resource gateway. + * Only the account that owns the resource gateway can create a resource configuration for that resource gateway. + + * The quota for the maximum number of resource gateways per VPC is enforced at the VPC owner account. Only the VPC owner can request an increase to this quota. This quota counts all resource gateways in the VPC, including those that participant accounts create in the VPC's shared subnets. + + * The VPC owner can't view or modify the resource gateways that participant accounts create, or the resource configurations for those resource gateways. + + * A participant account must specify at least one security group for its resource gateway, and must own every security group that it specifies. A participant account can't use the VPC's default security group or security groups that are shared with it. Specifying one of these returns a "cannot be found" error. + + * For a resource gateway that a participant account creates, the IP address and CIDR targets of a resource configuration must be within the subnets that are shared with that participant account. Each CIDR must be within a single shared subnet. IP address and CIDR ranges in on-premises networks, peered VPCs, or subnets that aren't shared with the participant account are rejected. Resources that other accounts own within the shared subnets are supported. + + * A resource configuration that targets an Amazon RDS database by ARN must reference a database in the resource gateway owner's account. + + * To reach a resource outside the shared subnets, such as an Amazon RDS database in the VPC owner's account, use a domain-name target. Domain-name targets aren't checked against the shared subnet ranges and work as long as routing allows.