Updated PrivateLink for new features, and clarity #813
Conversation
|
|
||
| [Back to top :arrow_up:](#table-of-contents) | ||
| ### VPC and Network Security Gotchas and Limitations | ||
| - 🔸VPCs are tied to one Region in one Account. Subnets are tied to one VPC and limited to one Availability Zone. | ||
| - 🔸Security groups are tied to one VPC. If you are utilizing infrastructure in multiple VPCs you should make sure your configuration/deployment tools take that into account. | ||
| - 🔸[VPC Endpoints](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.html) are currently only available for S3 and DynamoDB. If you have a security requirement to lockdown outbound traffic from your VPC you may want to use [DNS filtering](https://aws.amazon.com/blogs/security/how-to-add-dns-filtering-to-your-nat-instance-with-squid/) to control outbound traffic to other services. | ||
| - 🔸[VPC Endpoint gateways](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html) are currently only available for S3 and DynamoDB. If you have a security requirement to lockdown outbound traffic from your VPC you may want to use [DNS filtering](https://aws.amazon.com/blogs/security/how-to-add-dns-filtering-to-your-nat-instance-with-squid/) to control outbound traffic to other services. | ||
| - ❗Be careful when choosing your VPC IP CIDR block: If you are going to need to make use of [ClassicLink](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-classiclink.html), make sure that your private IP range [doesn’t overlap](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-classiclink.html#classiclink-limitations) with that of EC2 Classic. |
There was a problem hiding this comment.
I see you are changing http:// to https:// in a couple of places.
May be it is worth to change them in the whole document as well? ( I know it is a bit of a scope creep...)
There was a problem hiding this comment.
Unless someone can help with a programmatic way to grab all the URLs, test they work with HTTPS, then update them, I wouldn't be happy to blindly replace them, and there's 356 http:// links. I'd like to keep this PR contained too :)
There was a problem hiding this comment.
May be it is worth to change them in the whole document as well? ( I know it is a bit of a scope creep...)
In my opinion this shouldn't block a merge. It can be done incrementally.
There was a problem hiding this comment.
This is a comment, not a change request, I already added my approval.
No description provided.