Content tagged with "vpc"
Hands-on verification of VPC Encryption Controls Monitor/Enforce modes. Reveals that encryption-status 2 only applies to PrivateLink, Enforce migration takes 15+ minutes asynchronously, and VPC endpoint ENI migration can silently block the transition.
Verified centralized Network Firewall Proxy architecture across VPCs. SourceVpc enables per-VPC policy control via PrivateLink endpoints, while SourceIp is NATed and unusable in cross-VPC setups.
Enabled TLS intercept on Network Firewall Proxy using ACM Private CA. Verified PreRequest phase HTTP method blocking, PostResponse Content-Type filtering, and documented PCA configuration gotchas and Preview-specific limitations.
Hands-on verification of AWS Network Firewall Proxy (Public Preview). Tested NAT Gateway integration, PreDNS domain filtering, source-based access control, and DNS spoofing resistance.
verify-target-domain uses public access so private DNS returns UNREACHABLE, but VPC Config pentests perform separate internal verification during PREFLIGHT that succeeds.
Cross-VPC access through PrivateLink endpoints NATs the source IP to the endpoint's ENI IP. Use SourceVpc or SourceVpce instead of SourceIp for cross-VPC source identification.
EKS auto-created VPC endpoints persist after cluster deletion, leaving ENIs in-use and blocking VPC deletion with DependencyViolation. Explicitly delete VPC endpoints and wait for ENI release.
AgentCore Runtime's ENI in the VPC may stay in-use for hours after agentcore destroy. Wait for it to become available before deleting the subnet and VPC.