AWS ebs documentation change
Summary
Updated documentation to replace 'Dedicated Local Zones' with 'Local Zones', clarified snapshot storage locations, added new FAQ about snapshot consistency, and revised IAM policy examples for data residency enforcement.
Security assessment
The changes enhance documentation about using IAM policies to enforce data residency (e.g., preventing snapshots from leaving Local Zones) and clarify encryption requirements. However, there is no evidence of addressing a specific security vulnerability. The updates refine existing security controls rather than patching a flaw.
Diff
diff --git a/ebs/latest/userguide/snapshots-localzones.md b/ebs/latest/userguide/snapshots-localzones.md index f7658b680..faae06266 100644 --- a//ebs/latest/userguide/snapshots-localzones.md +++ b//ebs/latest/userguide/snapshots-localzones.md @@ -7 +7 @@ Frequently asked questionsConsiderationsControlling access with IAM -# Local snapshots in Dedicated Local Zones +# Local snapshots in Local Zones @@ -11 +11 @@ Amazon EBS snapshots are a point-in-time copy of your EBS volumes. -Snapshots of EBS volumes in a Dedicated Local Zone can be stored in Amazon S3 in the same Dedicated Local Zone or in the parent Region of that Dedicated Local Zone. Storing snapshots in a Dedicated Local Zone can help you meet data residency needs by ensuring that snapshot data is processed and stored in a specific country, state, or municipality. You can also set up data residency enforcement policies using IAM to ensure that snapshot data does not leave the Dedicated Local Zone. +Snapshots of EBS volumes in an AWS Local Zone can be stored in Amazon S3 in the same Local Zone or in the parent Region of that Local Zone. Storing snapshots in a Local Zone can help you meet data residency needs by ensuring that snapshot data is processed and stored in a specific country, state, or municipality. You can also set up data residency enforcement policies using IAM to ensure that snapshot data does not leave the Local Zone. @@ -13 +13 @@ Snapshots of EBS volumes in a Dedicated Local Zone can be stored in Amazon S3 in -AWS Dedicated Local Zones are a type of AWS Infrastructure that is fully managed by AWS, built for exclusive use by you or your community, and placed in a location or data center specified by you to help comply with regulatory requirements. Dedicated Local Zones are a type of AWS Local Zone offering. For more information, see [AWS Dedicated Local Zones](https://aws.amazon.com/dedicatedlocalzones/). +Local Zones are ideal for applications that require single-digit millisecond latency or local data processing by bringing AWS infrastructure closer to your end users and business centers. Additionally, you can meet data residency requirements for regulatory and compliance-sensitive workloads. For more information, see [What is AWS Local Zones](https://docs.aws.amazon.com/local-zones/latest/ug/what-is-aws-local-zones.html). @@ -15 +15 @@ AWS Dedicated Local Zones are a type of AWS Infrastructure that is fully managed -Local snapshots are not currently supported in other [AWS Local Zones locations](https://aws.amazon.com/about-aws/global-infrastructure/localzones/locations/). +Local snapshots are currently supported in Local Zones that support Amazon S3. For more information, see [AWS Local Zones features.](https://aws.amazon.com/about-aws/global-infrastructure/localzones/features/). @@ -30 +30 @@ Local snapshots are not currently supported in other [AWS Local Zones locations] -**1\. What are Local snapshots in Dedicated Local Zones?** +**1\. What are Local snapshots in Local Zones?** @@ -33 +33 @@ Local snapshots are not currently supported in other [AWS Local Zones locations] -Local snapshots in Dedicated Local Zones are snapshots that are stored in Amazon S3 in a Dedicated Local Zone. Like snapshots in AWS Regions, Local snapshots in Dedicated Local Zones are incremental, which means that only the blocks of the volume that have changed after your most recent snapshot are saved. You can use these snapshots to restore an Amazon EBS volume in the same Dedicated Local Zone at any time. +Local snapshots in Local Zones are snapshots that are stored in Amazon S3 in a Local Zone. By default, snapshots of Amazon EBS volumes in a Local Zone are stored in Amazon S3 in the parent Region. If the Local Zone supports Amazon S3, you can choose to store the snapshots locally in the Local Zone instead. Like snapshots in AWS Regions, Local snapshots in Local Zones are incremental, which means that only the blocks of the volume that have changed after your most recent snapshot are saved. You can use these snapshots to restore an Amazon EBS volume in the same Local Zone at any time. @@ -35 +35 @@ Local snapshots in Dedicated Local Zones are snapshots that are stored in Amazon -**2\. Why should I use local snapshots?** +**2\. Why should I use Local snapshots?** @@ -38 +38 @@ Local snapshots in Dedicated Local Zones are snapshots that are stored in Amazon -Use Local snapshots in Dedicated Local Zones to meet data residency or data isolation requirements by ensuring that your snapshot data resides in a specific geographic location, such as a country, state, or municipality. +Use Local snapshots in Local Zones to meet data residency or data isolation requirements by ensuring that your snapshot data resides in a specific geographic location, such as a country, state, or municipality. @@ -40 +40 @@ Use Local snapshots in Dedicated Local Zones to meet data residency or data isol -**3\. How do I enforce snapshot data residency in Dedicated Local Zones?** +**3\. How do I enforce snapshot data residency in Local Zones?** @@ -43 +43 @@ Use Local snapshots in Dedicated Local Zones to meet data residency or data isol -You can use AWS Identity and Access Management (IAM) policies to control the permissions that principals (AWS accounts, IAM users, and IAM roles) have when working with Local snapshots in Dedicated Local Zones and to enforce data residency. For example, you can create a policy that prevents users from creating snapshots from volumes in a Dedicated Local Zones and storing those snapshots in an AWS Region. For more information, see Controlling access with IAM. +You can use AWS Identity and Access Management (IAM) policies to control the permissions that principals (AWS accounts, IAM users, and IAM roles) have when working with Local snapshots in Local Zones and to enforce data residency. For example, you can create a policy that prevents users from creating snapshots from volumes in a Local Zones and storing those snapshots in an AWS Region. For more information, see Controlling access with IAM. @@ -45 +45 @@ You can use AWS Identity and Access Management (IAM) policies to control the per -**4\. Are multi-volume, crash-consistent local snapshots supported?** +**4\. Are multi-volume, crash-consistent Local snapshots supported?** @@ -48 +48 @@ You can use AWS Identity and Access Management (IAM) policies to control the per -Yes, you can create multi-volume, crash-consistent Local snapshots in Dedicated Local Zones from instances in a Dedicated Local Zone. +Yes, you can create multi-volume, crash-consistent Local snapshots in Local Zones from instances in a Local Zone. @@ -50 +50 @@ Yes, you can create multi-volume, crash-consistent Local snapshots in Dedicated -**5\. How do I create Local snapshots in Dedicated Local Zones?** +**5\. How do I create Local snapshots in Local Zones?** @@ -53 +53 @@ Yes, you can create multi-volume, crash-consistent Local snapshots in Dedicated -You can create Local snapshots in Dedicated Local Zones manually using the AWS CLI or the Amazon EC2 console. For more information see, [Create a snapshot of an EBS volume](./ebs-create-snapshot.html). You can also automate the lifecycle of Local snapshots in Dedicated Local Zones using Amazon Data Lifecycle Manager. For more information see, [Create Amazon Data Lifecycle Manager custom policy for EBS snapshots](./snapshot-ami-policy.html). +You can create Local snapshots in Local Zones manually using the AWS CLI or the Amazon EC2 console. For more information see, [Create a snapshot of an EBS volume](./ebs-create-snapshot.html). You can also automate the lifecycle of Local snapshots in Local Zones using Amazon Data Lifecycle Manager. For more information see, [Create Amazon Data Lifecycle Manager custom policy for EBS snapshots](./snapshot-ami-policy.html). @@ -55 +55 @@ You can create Local snapshots in Dedicated Local Zones manually using the AWS C -**6\. Can I copy Local snapshots in Dedicated Local Zones?** +**6\. Can I copy Local snapshots in Local Zones?** @@ -58 +58 @@ You can create Local snapshots in Dedicated Local Zones manually using the AWS C -No, you can't currently copy snapshots from a Region to a Dedicated Local Zone, from a Dedicated Local Zone to a Region, or from one Dedicated Local Zone to another. +No, you can't currently copy snapshots from a Region to a Local Zone, from a Local Zone to a Region, or from one Local Zone to another. @@ -60 +60 @@ No, you can't currently copy snapshots from a Region to a Dedicated Local Zone, -**7\. How can I restore data from Local snapshots in Dedicated Local Zones?** +**7\. How can I restore data from Local snapshots in Local Zones?** @@ -63 +63 @@ No, you can't currently copy snapshots from a Region to a Dedicated Local Zone, -You can use Local snapshots in Dedicated Local Zones to create Amazon EBS volumes in the same Dedicated Local Zone only. +You can use Local snapshots in Local Zones to create Amazon EBS volumes in the same Local Zone only. @@ -65 +65 @@ You can use Local snapshots in Dedicated Local Zones to create Amazon EBS volume -**8\. How are Local snapshots in Dedicated Local Zones encrypted?** +**8\. How are Local snapshots in Local Zones encrypted?** @@ -68 +68 @@ You can use Local snapshots in Dedicated Local Zones to create Amazon EBS volume -Local snapshots in Dedicated Local Zones are encrypted by default. Unencrypted Local snapshots in Dedicated Local Zones are not supported. Local snapshots in Dedicated Local Zones are encrypted using the same KMS key as the source Amazon EBS volume. +Local snapshots can be unencrypted or encrypted by default. When encrypted by default, Local snapshots are encrypted using the same AWS KMS key as the source Amazon EBS volume. When you create a volume from a Local snapshot, you can't re-encrypt the volume using a different KMS key. Volumes created from Local snapshots must be encrypted using the same AWS KMS key as the source snapshot. @@ -70 +70 @@ Local snapshots in Dedicated Local Zones are encrypted by default. Unencrypted L -**9\. Can I create EBS-backed AMIs using Local snapshots in Dedicated Local Zones?** +**9\. Can I create EBS-backed AMIs using Local snapshots in Local Zones?** @@ -73 +73 @@ Local snapshots in Dedicated Local Zones are encrypted by default. Unencrypted L -No, you can't currently create EBS-backed AMIs using Local snapshots in Dedicated Local Zones. +No, you can't currently create EBS-backed AMIs using Local snapshots in Local Zones. @@ -75 +75 @@ No, you can't currently create EBS-backed AMIs using Local snapshots in Dedicate -**10\. Can I share Local snapshots in Dedicated Local Zones?** +**10\. Can I share Local snapshots in Local Zones?** @@ -78 +78,6 @@ No, you can't currently create EBS-backed AMIs using Local snapshots in Dedicate -Yes, you can share Local snapshots in Dedicated Local Zones with other AWS accounts that have enabled the Dedicated Local Zone for use in their account. +Yes, you can share Local snapshots in Local Zones with other AWS accounts that have enabled the Local Zone for use in their account. + +**11\. Can I create a Local snapshot of a volume and then switch to creating snapshots in the parent Region?** + + +No, after you create a Local snapshot of a volume, you can't create successive snapshots of that volume in the Parent Region. Since all snapshots are incremental, if the most recent snapshot of a volume is a Local snapshot, then all successive snapshots of that volume must be Local snapshots. @@ -82 +87 @@ Yes, you can share Local snapshots in Dedicated Local Zones with other AWS accou -Keep the following in mind when working with Local snapshots in Dedicated Local Zones. +Keep the following in mind when working with Local snapshots in Local Zones. @@ -84 +89 @@ Keep the following in mind when working with Local snapshots in Dedicated Local - * Local snapshots are supported in [AWS Dedicated Local Zones](https://aws.amazon.com/dedicatedlocalzones/) only. They are not supported in [ other Local Zones locations](https://aws.amazon.com/about-aws/global-infrastructure/localzones/locations/). + * Local snapshots are currently supported in Local Zones that support Amazon S3. @@ -86 +91 @@ Keep the following in mind when working with Local snapshots in Dedicated Local - * The following features can't be used with Local snapshots in Dedicated Local Zones: + * The following features can't be used with Local snapshots in Local Zones: @@ -98,2 +102,0 @@ Keep the following in mind when working with Local snapshots in Dedicated Local - * Snapshot lock - @@ -101,0 +105,2 @@ Keep the following in mind when working with Local snapshots in Dedicated Local + * If the most recent snapshot of a volume is a Local snapshot, then all successive snapshots must be Local snapshots. Similarly, if the most recent snapshot of a volume is stored in an AWS Region, then all successive snapshots must be stored in the same Region. + @@ -107 +112 @@ Keep the following in mind when working with Local snapshots in Dedicated Local -You can use AWS Identity and Access Management (IAM) policies to control the permissions that principals (AWS accounts, IAM users, and IAM roles) have when working with Local snapshots in Dedicated Local Zones. The following are example policies that you can use to grant or deny permission to perform specific actions with Local snapshots in Dedicated Local Zones. +You can use AWS Identity and Access Management (IAM) policies to control the permissions that principals (AWS accounts, IAM users, and IAM roles) have when working with Local snapshots in Local Zones. The following are example policies that you can use to grant or deny permission to perform specific actions with Local snapshots in Local Zones. @@ -111 +116 @@ You can use AWS Identity and Access Management (IAM) policies to control the per - * Enforce data residency for Local snapshots in Dedicated Local Zones + * Enforce data residency for Local snapshots in Local Zones @@ -113 +118 @@ You can use AWS Identity and Access Management (IAM) policies to control the per - * Prevent sharing of Local snapshots in Dedicated Local Zones + * Prevent sharing of Local snapshots in Local Zones @@ -115 +120 @@ You can use AWS Identity and Access Management (IAM) policies to control the per - * Prevent principals from deleting Local snapshots in Dedicated Local Zones + * Prevent principals from deleting Local snapshots in Local Zones @@ -120 +125 @@ You can use AWS Identity and Access Management (IAM) policies to control the per -### Enforce data residency for Local snapshots in Dedicated Local Zones +### Enforce data residency for Local snapshots in Local Zones @@ -122 +127 @@ You can use AWS Identity and Access Management (IAM) policies to control the per -The following example policy restricts users to creating only Local snapshots in Dedicated Local Zones from volumes and instances in a Dedicated Local Zone. It prevents users from creating snapshots in a Region from volumes and instances in a Dedicated Local Zone. +The following example policy restricts users to creating only Local snapshots in Local Zones from volumes and instances in a Local Zone. It prevents users from creating snapshots in a Region from volumes and instances in a Local Zone. @@ -127 +132,2 @@ The following example policy restricts users to creating only Local snapshots in - "Statement": [ + "Statement": + [ @@ -129,2 +135,3 @@ The following example policy restricts users to creating only Local snapshots in - "Effect": "Allow", - "Action": [ + "Effect": "Deny", + "Action": + [ @@ -134,4 +141,9 @@ The following example policy restricts users to creating only Local snapshots in - "Resource": "arn:aws:ec2:region::snapshot/*", - "Condition": { - "StringEquals": { - "ec2:SourceAvailabilityZone": "dedicated_local_zone" + "Resource": "*", + "Condition": + { + "StringEquals": + { + "ec2:Location": "regional", + "ec2:SourceAvailabilityZone": "local_zone" + } + } @@ -139,2 +151,17 @@ The following example policy restricts users to creating only Local snapshots in - "StringEquals": { - "ec2:Location": "local" + { + "Effect": "Deny", + "Action": + [ + "ec2:CreateSnapshot", + "ec2:CreateSnapshots" + ], + "Resource": "*", + "Condition": + { + "StringEquals": + { + "ec2:SourceAvailabilityZone": "local_zone" + }, + "Null": + { + "ec2:Location": "true" @@ -142,0 +170,9 @@ The following example policy restricts users to creating only Local snapshots in + }, + { + "Effect": "Allow", + "Action": + [ + "ec2:CreateSnapshot", + "ec2:CreateSnapshots" + ], + "Resource": "*" @@ -147 +183 @@ The following example policy restricts users to creating only Local snapshots in -### Prevent sharing of Local snapshots in Dedicated Local Zones +### Prevent sharing of Local snapshots in Local Zones @@ -149 +185 @@ The following example policy restricts users to creating only Local snapshots in -The following example policy prevents all users from sharing Local snapshots in Dedicated Local Zones. +The following example policy prevents all users from sharing Local snapshots in Local Zones. @@ -163 +199 @@ The following example policy prevents all users from sharing Local snapshots in - "ec2:AvailabilityZone": "dedicated_local_zone" + "ec2:AvailabilityZone": "local_zone" @@ -177 +213 @@ The following example policy prevents all users from sharing Local snapshots in -### Prevent principals from deleting Local snapshots in Dedicated Local Zones +### Prevent principals from deleting Local snapshots in Local Zones @@ -179 +215 @@ The following example policy prevents all users from sharing Local snapshots in -The following example policy prevents all users from deleting Local snapshots in Dedicated Local Zones. +The following example policy prevents all users from deleting Local snapshots in Local Zones. @@ -193 +229 @@ The following example policy prevents all users from deleting Local snapshots in - "ec2:AvailabilityZone": "dedicated_local_zone" + "ec2:AvailabilityZone": "local_zone"