AWS drs medium security documentation change
Summary
Clarified VPC endpoint usage for management traffic only, removed region support note, and made minor grammatical improvements
Security assessment
Added explicit statement that the VPC endpoint is used exclusively for management traffic, which helps prevent accidental exposure of replication data through improper network configuration. This change emphasizes security best practices by separating control plane and data plane traffic.
Diff
diff --git a/drs/latest/userguide/installing-agent-blocked.md b/drs/latest/userguide/installing-agent-blocked.md index dbd024ed7..bfa955c4a 100644 --- a//drs/latest/userguide/installing-agent-blocked.md +++ b//drs/latest/userguide/installing-agent-blocked.md @@ -11,5 +11 @@ The AWS DRS AWS Replication Agent installer needs network access to AWS Elastic -You can connect your on premise network to the subnet in your staging area VPC using AWS VPN or DirectConnect. To use the AWS VPN or DirectConnect, you must activate private IP in the replication settings - -###### Note - -This feature is not supported in the Asia Pacific (Hyderabad), Asia Pacific (Jakarta), Asia Pacific (Melbourne), Asia Pacific (Osaka), Europe (Spain), Europe (Zurich), and Middle East (UAE) Regions. +You can connect your on premise network to the subnet in your staging area VPC using AWS VPN or DirectConnect. To use the AWS VPN or DirectConnect, you must activate private IP in the replication settings. @@ -19 +15 @@ This feature is not supported in the Asia Pacific (Hyderabad), Asia Pacific (Jak -To allow the AWS Replication Agent installer to communicate with AWS Elastic Disaster Recovery, create an interface VPC endpoint for AWS Elastic Disaster Recovery in your staging area subnet. For more information, see [Creating an Interface Endpoint](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint.html) in the Amazon VPC User Guide. +To allow the AWS Replication Agent installer to communicate with AWS Elastic Disaster Recovery, create an interface VPC endpoint for AWS Elastic Disaster Recovery in your staging area subnet. This VPC endpoint is used exclusively for management traffic; replication data is transmitted directly between the source and replication servers. For more information, see [Creating an Interface Endpoint](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint.html) in the Amazon VPC User Guide. @@ -35 +31 @@ Once you have created the VPC Endpoint, the AWS Replication Agent can connect to -Run the AWS Replication Agent installer with the --endpoint parameter. Enter your endpoint-specific DNS hostname within the parameter. The installer will then be able to connect to AWS Elastic Disaster Recovery via the endpoint over your VPN/DirectConnect connection. +Run the AWS Replication Agent installer with the --endpoint parameter. Enter your endpoint-specific DNS hostname within the parameter. The installer is then able to connect to AWS Elastic Disaster Recovery via the endpoint over your VPN/DirectConnect connection. @@ -47 +43 @@ Once you have created the interface VPC Endpoint, the AWS Replication Agent can -Run the AWS Replication Agent installer with the --s3-endpoint parameter. Enter your endpoint-specific DNS hostname. The installer will then be able to connect to Elastic Disaster Recovery via the endpoint over your VPN/DirectConnect connection. +Run the AWS Replication Agent installer with the --s3-endpoint parameter. Enter your endpoint-specific DNS hostname. The installer is then able to connect to Elastic Disaster Recovery via the endpoint over your VPN/DirectConnect connection.