Changelog¶
Content changes that alter a decision are recorded here, newest first and grouped by the month the pull request merged. The first entries cover July 2026. Typo fixes, dead-link fixes, formatting, CI, and site metadata changes are not listed; the commit history has them. Use this page to check whether a recommendation changed after you last read it, or whether an AI model answering from older training data still reflects the current guidance.
Inclusion rule: an entry belongs here if a reader who applied the old version of the page would now make a different decision.
| Icon | Type | Use when |
|---|---|---|
| 🆕 | New guidance | A new best practice, section, or service capability is documented |
| 🔄 | Changed recommendation | The advice or default choice differs from before |
| 🔧 | Correction | A factual, technical, or diagram error is fixed in a way that changes what a reader would do |
| 🗑️ | Removed | Guidance, a recommendation, or a section is retired |
October 2026¶
- 🆕 New guidance — Perimeter Controls: AWS Cloud WAN service insertion is a second way to route traffic to a centralized inspection VPC, alongside AWS Transit Gateway routing to a shared inspection VPC. AWS Firewall Manager is optional for centralized inspection. Per-VPC inspection through Firewall Manager remains the default for environments with many VPCs. (#166)
- 🔧 Correction — Perimeter Controls: Previously the stateless and stateful rule split was presented as a cost lever. Now the page states that AWS Network Firewall charges for endpoint hours and gigabytes processed regardless of which rule engine evaluates the traffic, so the split is a rule design choice, not a way to reduce the processing charge. (#166)
- 🆕 New guidance — Load Balancing: Gateway Load Balancer can send a TCP reset when a target becomes unhealthy, is deregistered, or a flow idles out, so senders open a new flow instead of waiting for TCP retries to expire. All three settings are off by default, including on existing load balancers, and require 5-tuple flow stickiness. When you raise the TCP idle timeout above 350 seconds, keep the target's connection-tracking idle timeout at or above the Gateway Load Balancer value. (#167)
- 🆕 New guidance — DNS Architecture: Deliver Amazon Route 53 Resolver query logs to Amazon CloudWatch Logs to build metric filters and alarms, and alarm directly on the DNS Firewall query-volume metrics. Query logs miss cached lookups, DNS-over-HTTPS, and hardcoded-IP traffic, so treat this as detection, not prevention. (#175)
- 🆕 New guidance — Outbound Controls: Network Firewall container associations track Amazon ECS tasks and Amazon EKS pods as a dynamic source IP set, so workloads that share a VPC can have different egress rules. Unmet constraints, such as source NAT left enabled on the Amazon EKS VPC CNI, make a rule silently never match. (#176)
- 🆕 New guidance — Connectivity Within AWS: Amazon VPC Lattice VPC Resources can represent a CIDR range reached through a tunnel endpoint with GENEVE encapsulation, for segments whose hosts are not known in advance. CIDR-range configurations do not NAT, cannot join a service network, and have no custom domain names, so the overlapping-CIDR advantage applies only to single, group, and ARN configurations. (#174)
- 🔄 Changed recommendation — Remote Access: Previously SSH and RDP access was listed as a reason to choose AWS Client VPN, and AWS Verified Access was described as needing no VPN client. Now TCP, SSH, and RDP access to specific applications fits Verified Access (non-HTTP(S) endpoints need its Connectivity Client), and Client VPN is for ad-hoc access across many hosts and ports, non-TCP protocols, and IP-based legacy applications. (#173)
- 🆕 New guidance — Remote Access: Client VPN can require device posture in addition to user identity, checked at connect time and re-evaluated for the life of the session. Posture-gated endpoints accept only the AWS provided client, so confirm device trust provider coverage and run the policy in shadow mode before enforcing. (#173)
August 2026¶
- 🆕 New guidance — Load Balancing: Default to dual-stack Network Load Balancers for new deployments, with listener rules that send each address family to its own target group so client IPs are preserved end to end. Target security groups must permit health checks over both families, and UDP listeners need an IPv6 target group before you split traffic by family. (#161)
- 🔧 Correction — Hybrid and Multi-Cloud Connectivity: Previously one list of BGP attributes was given for all virtual interfaces, with Local Preference communities described as applying to routes from AWS. Now the attributes are set on routes you advertise to AWS, Local Preference and MED apply to private and transit virtual interfaces, and scope communities control how far AWS propagates prefixes from a public virtual interface. (#160)
- 🆕 New guidance — Hybrid and Multi-Cloud Connectivity: AWS Direct Connect BGP route visibility lists the accepted and advertised routes on each virtual interface with AS path and community values. Alarm on the BGP session and prefix-count metrics, then read the route list to find which prefix changed. (#160)
- 🆕 New guidance — Connectivity Within AWS: Transit Gateway Policy-Based Routing selects the route table per flow by source and destination CIDR, port, and protocol, at no additional charge. Traffic that matches no rule is dropped, so end every policy table with a catch-all. An IPv4-only rule does not match IPv6 traffic, which then falls through to that catch-all. (#158)
July 2026¶
- 🔧 Correction — Perimeter Controls: Previously the perimeter control layers diagram grouped network ACLs with Network Firewall at the VPC boundary and showed security groups at the subnet layer. Now network ACLs sit at the subnet boundary, security groups at the resource network interface, and AWS Global Accelerator is removed because it is a routing tool, not a perimeter control. (#157)
- 🔄 Changed recommendation — Hybrid and Multi-Cloud Connectivity: Previously an AWS Interconnect Region pair that was not yet supported pointed to partner-based AWS Direct Connect or VPN. Now land on a supported pair and carry the remaining leg inside each cloud, and keep partner-based options for clouds Interconnect does not support or where an existing colocation footprint is cheaper. (#155)
- 🆕 New guidance — Hybrid and Multi-Cloud Connectivity: A single Interconnect carries a 99.99% monthly uptime SLA because the redundancy is inside the object. A second Interconnect on the same Region pair doubles cost without raising that commitment, and SLA eligibility requires the endpoint to span two or more Availability Zones. (#155)
- 🔧 Correction — Hybrid and Multi-Cloud Connectivity: Previously Interconnect pricing was described as hourly by bandwidth tier plus data transfer. Now it is an hourly rate set by provisioned bandwidth and a distance-based pricing tier with no per-GB charge, and adding a distant Cloud WAN Core Network Edge can raise the tier. (#155)