AWS fis documentation change
Summary
Added documentation for ARC Zonal Autoshift recovery action including timing details, targeting logic, and IAM service-linked role information
Security assessment
The changes describe availability improvements through zonal traffic shifting during AZ impairments, but do not address security vulnerabilities or introduce security features. Focus is on reliability and recovery processes.
Diff
diff --git a/fis/latest/userguide/az-availability-scenario.md b/fis/latest/userguide/az-availability-scenario.md index 32774c266..22c3e677e 100644 --- a/fis/latest/userguide/az-availability-scenario.md +++ b/fis/latest/userguide/az-availability-scenario.md @@ -58,0 +59,6 @@ This action targets ElastiCache replication groups. By default, it targets repli +### Start ARC Zonal Autoshift + +Five minutes after the AZ power interruption begins, the recovery action `aws:arc:start-zonal-autoshift` automatically shifts resource traffic away from the specified AZ for the remaining 25 minutes of the power interruption. After that duration, traffic shifts back to the original AZ. Note that during a real-world AZ power interruption AWS will detect the impairment and shift resource traffic if autoshift is enabled. While the timing of this shift varies it is estimated to occur five minutes from the impairment commencing. + +This action targets Amazon Application Recovery Controller (ARC) autoshift-enabled resources. By default, it targets resources with the tag key `AzImpairmentPower` and value `Recover-autoshift-resources`. You can add this tag to your resources or replace the default tag with your own tag in the experiment template. For example, you may want to use an application-specific tag. By default, if no valid resources are found this action will be skipped. + @@ -88,0 +95,2 @@ By default, only volumes set to persist after the instance is terminated are tar +ARC zonal autoshift uses an IAM service-linked role `AWSServiceRoleForZonalAutoshiftPracticeRun` to perform zonal shift on your behalf. This role uses the IAM managed policy [`AWSZonalAutoshiftPracticeRunSLRPolicy`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSZonalAutoshiftPracticeRunSLRPolicy.html). You don’t need to create the role manually. When you create an experiment template from the AZ Power Interruption scenario in the AWS Management Console, the AWS CLI, or an AWS SDK, ARC creates the service-linked role for you. For more information, see [Using the service-linked role for zonal autoshift in ARC](https://docs.aws.amazon.com/r53recovery/latest/dg/using-service-linked-roles-zonal-autoshift.html). +