AWS drs documentation change
Summary
Minor grammatical corrections and clarification of instructions regarding instance profile management, IAM role assignment, and replication behavior
Security assessment
Changes focus on improving clarity of existing security-related processes (IAM roles, SSM requirements) but do not introduce new security controls or address specific vulnerabilities. Updates emphasize proper configuration of existing security mechanisms rather than patching weaknesses.
Diff
diff --git a/drs/latest/userguide/adding-servers-from-aws-instances.md b/drs/latest/userguide/adding-servers-from-aws-instances.md index 749e5a41b..de53bd268 100644 --- a//drs/latest/userguide/adding-servers-from-aws-instances.md +++ b//drs/latest/userguide/adding-servers-from-aws-instances.md @@ -17 +17 @@ You can protect your EC2 instances using AWS Elastic Disaster Recovery (DRS) in -You will need an instance profile with the policies listed below in order to have your instances managed by SSM and for installing the AWS replication agent: +You need an instance profile with the policies listed below in order to have your instances managed by SSM and for installing the AWS replication agent: @@ -32 +32 @@ Successfully installing the AWS replication agent adds the instance to AWS DRS ( -Any additional EBS volumes added during the EC2 Instance creation that are offline, unmounted, or unformatted will not be replicated. Any volume that is later placed online or mounted with a valid file system will automatically be replicated if [Automatically replicate new disks](https://docs.aws.amazon.com/drs/latest/userguide/volumes-drs.html#auto-replicate) is enabled. +Any additional EBS volumes added during the EC2 Instance creation that are offline, unmounted, or unformatted are not replicated. Any volume that is later placed online or mounted with a valid file system is automatically replicated if [Automatically replicate new disks](https://docs.aws.amazon.com/drs/latest/userguide/volumes-drs.html#auto-replicate) is enabled. @@ -36 +36 @@ This section lists all the instances that were selected to be protected by AWS D -To have an instance managed by SSM, requires the SSM agent to be installed on a compatible operating system ([or preinstalled in the AMI](https://docs.aws.amazon.com/systems-manager/latest/userguide/ami-preinstalled-agent.html)), and the instance to have the correct permissions (as defined in the [AmazonSSMManagedInstanceCore](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html) and the [AWSElasticDisasterRecoveryEC2InstancePolicy](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryEc2InstancePolicy.html) policies). To update the instance profiles, the **Instance profile role installation** section allows to create the default instance profile (with the two policies mentioned above) if needed. The **Instance profiles** section allows to assign instance profiles to instances, and will automatically assign the default instance profile to all instances that do not have any instance profile attached to them. Use the **Attach profiles to all instances** button to attach the assigned instance profiles to the instances in case the default profile was created and automatically assigned to them or if you changed the assigned instance profile. +To have an instance managed by SSM, requires the SSM agent to be installed on a compatible operating system ([or preinstalled in the AMI](https://docs.aws.amazon.com/systems-manager/latest/userguide/ami-preinstalled-agent.html)), and the instance to have the correct permissions (as defined in the [AmazonSSMManagedInstanceCore](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html) and the [AWSElasticDisasterRecoveryEC2InstancePolicy](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryEc2InstancePolicy.html) policies). To update the instance profiles, the **Instance profile role installation** section allows you to create the default instance profile (with the two policies mentioned above) if needed. The **Instance profiles** section allow you to assign instance profiles to instances, and automatically assigns the default instance profile to all instances that do not have any instance profile attached to them. Use the **Attach profiles to all instances** button to attach the assigned instance profiles to the instances in case the default profile was created and automatically assigned to them or if you changed the assigned instance profile. @@ -40 +40 @@ To have an instance managed by SSM, requires the SSM agent to be installed on a -On this section, you can define the target disaster recovery region. This can be the same region where the instances are present in, or it can be a different region, for cross-region protection. AWS DRS must be initialized in the target region in order to protect the instances onto that region. The indicator next to the region’s name will show if AWS DRS is already initialized in the target region, or not. If the region is not initialized, a button labelled Initialize and configure AWS Elastic Disaster Recovery will be visible and active. Clicking this button opens the AWS DRS initialization wizard for AWS DRS in the target region on another browser tab. +On this section, you can define the target disaster recovery region. This can be the same region where the instances are present in, or it can be a different region, for cross-region protection. AWS DRS must be initialized in the target region in order to protect the instances onto that region. The indicator next to the region’s name shows if AWS DRS is already initialized in the target region, or not. If the region is not initialized, a button labelled Initialize and configure AWS Elastic Disaster Recovery is visible and active. Choosing this button opens the AWS DRS initialization wizard for AWS DRS in the target region on another browser tab. @@ -44 +44 @@ On this section, you can define the target disaster recovery region. This can be -This section provides you with the option to create the default IAM role with the required permissions as an instance profile. The role **AWSElasticDisasterRecoveryAutomatedAgentInstallRole** includes the permissions defined in the policies [AmazonSSMManagedInstanceCore](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html) and [AWSElasticDisasterRecoveryEC2InstancePolicy](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryEc2InstancePolicy.html). These permissions are required to allow the SSM agent to operate and to install the AWS replication agent, respectively. Clicking the **Install default IAM role** installs this role. This needs to be done only once per account. If the role was already installed in the account, this button is inactive. The default instance profile role will be automatically assigned to instances without an instance profile in the **Instance profiles** section. If you click the **Attach profiles to all instances** button, this role will be attached to all instances it was assigned to in the **Instance profiles** section. If this default IAM role is not installed, you will need to make sure you have an instance profile with the [AmazonSSMManagedInstanceCore](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html) and [AWSElasticDisasterRecoveryEC2InstancePolicy](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryEc2InstancePolicy.html) policies (or the combined set of permissions within both of these policies). +This section provides you with the option to create the default IAM role with the required permissions as an instance profile. The role **AWSElasticDisasterRecoveryAutomatedAgentInstallRole** includes the permissions defined in the policies [AmazonSSMManagedInstanceCore](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html) and [AWSElasticDisasterRecoveryEC2InstancePolicy](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryEc2InstancePolicy.html). These permissions are required to allow the SSM agent to operate and to install the AWS replication agent, respectively. Clicking the **Install default IAM role** installs this role. This needs to be done only once per account. If the role was already installed in the account, this button is inactive. The default instance profile role is automatically assigned to instances without an instance profile in the **Instance profiles** section. If you click the **Attach profiles to all instances** button, this role is attached to all instances it was assigned to in the **Instance profiles** section. If this default IAM role is not installed, you need to make sure you have an instance profile with the [AmazonSSMManagedInstanceCore](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html) and [AWSElasticDisasterRecoveryEC2InstancePolicy](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryEc2InstancePolicy.html) policies (or the combined set of permissions within both of these policies). @@ -48 +48 @@ This section provides you with the option to create the default IAM role with th -This section lists all the instances that were selected to be protected by adding them as source servers to AWS DRS and their current instance profiles. Instances without any instance profile will have the **AWSElasticDisasterRecoveryAutomatedAgentInstallRole** instance profile and IAM role assigned to them if it exists on this account. Using the default profile is not mandatory, as any instance profile in the account can be assigned to any instance, but care must be taken to verify each instance has an instance profile with the permissions defined in the [AmazonSSMManagedInstanceCore](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html) and [AWSElasticDisasterRecoveryEC2InstancePolicy](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryEc2InstancePolicy.html) policies. +This section lists all the instances that were selected to be protected by adding them as source servers to AWS DRS and their current instance profiles. Instances without any instance profile have the **AWSElasticDisasterRecoveryAutomatedAgentInstallRole** instance profile and IAM role assigned to them if it exists on this account. Using the default profile is not mandatory, as any instance profile in the account can be assigned to any instance, but care must be taken to verify each instance has an instance profile with the permissions defined in the [AmazonSSMManagedInstanceCore](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html) and [AWSElasticDisasterRecoveryEC2InstancePolicy](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryEc2InstancePolicy.html) policies. @@ -60 +60 @@ Click the button labelled **Attach profiles to all instances** to attach the ass -After attaching such a profile, allow AWS DRS a few minutes to identify the instance as managed by SSM. If SSM is present on the instance, and an instance profile with the needed permissions was attached to the instance, then within a few minutes, the marker near the instance ID will change to show that the instance is currently managed by SSM. +After attaching such a profile, allow AWS DRS a few minutes to identify the instance as managed by SSM. If SSM is present on the instance, and an instance profile with the needed permissions was attached to the instance, then within a few minutes, the marker near the instance ID changes to show that the instance is currently managed by SSM. @@ -68 +68 @@ Clicking this button attaches the instance profiles assigned in the **Instance p -Click this button to install the AWS replication agent on all instances that are currently managed by SSM. If there are such instances, AWS DRS will list all these instances and the progress of installing the AWS replication agent on them. Successfully installing the AWS replication agent on these instances adds them as source servers to AWS DRS. If there are no instances that are currently managed by SSM, try installing the SSM agent on these instances, then attach an appropriate instance profile to them. +Click this button to install the AWS replication agent on all instances that are currently managed by SSM. If there are such instances, AWS DRS lists those instances and the progress of installing the AWS replication agent on them. Successfully installing the AWS replication agent on these instances adds them as source servers to AWS DRS. If there are no instances that are currently managed by SSM, try installing the SSM agent on these instances, then attach an appropriate instance profile to them.