AWS datasync documentation change
Summary
Added support for agentless transfers between commercial/GovCloud regions using Enhanced mode, marked agent creation as optional, and emphasized IAM role security over long-term credentials.
Security assessment
Promotes using IAM roles instead of long-term credentials (security best practice) and reduces potential attack surface by enabling agentless transfers. However, this appears to be a feature enhancement rather than addressing a specific security incident.
Diff
diff --git a/datasync/latest/userguide/create-s3-location.md b/datasync/latest/userguide/create-s3-location.md index e41005974..b3fafb79c 100644 --- a//datasync/latest/userguide/create-s3-location.md +++ b//datasync/latest/userguide/create-s3-location.md @@ -767 +767 @@ With DataSync, you can move data to or from S3 buckets in [different AWS account -By default, DataSync doesn't transfer between S3 buckets in commercial and AWS GovCloud (US) Regions. You can still set up this kind of transfer, though, by creating an object storage location for one of the S3 buckets in your transfer. This type of location requires a DataSync agent. +By default, DataSync doesn't transfer between S3 buckets in commercial and AWS GovCloud (US) Regions. You can still set up this kind of transfer, though, by creating an object storage location for one of the S3 buckets in your transfer. You can perform this type of transfer with or without an agent. If you use an agent, your task must be configured for **Basic** mode. To transfer without an agent, you must use **Enhanced** mode. @@ -775 +775 @@ By default, DataSync doesn't transfer between S3 buckets in commercial and AWS G - * [Creating your DataSync agent](./create-s3-location.html#create-s3-location-govcloud-create-agent) + * [Creating your DataSync agent (optional)](./create-s3-location.html#create-s3-location-govcloud-create-agent) @@ -790 +790 @@ IAM users have long-term credentials, which presents a security risk. To help mi -### Creating your DataSync agent +### Creating your DataSync agent (optional) @@ -792 +792 @@ IAM users have long-term credentials, which presents a security risk. To help mi -Since you're transferring between a commercial and AWS GovCloud (US) Region, you deploy your DataSync agent as an Amazon EC2 instance in one of the Regions. We recommend that your agent use a VPC service endpoint to avoid data transfer charges out to the public internet. For more information, see [Amazon EC2 Data Transfer pricing](https://aws.amazon.com/ec2/pricing/on-demand/#Data_Transfer). +If you want to run your transfer using **Basic** mode, then you will need to use an agent. Because you're transferring between a commercial and AWS GovCloud (US) Region, you deploy your DataSync agent as an Amazon EC2 instance in one of the Regions. We recommend that your agent use a VPC service endpoint to avoid data transfer charges out to the public internet. For more information, see [Amazon EC2 Data Transfer pricing](https://aws.amazon.com/ec2/pricing/on-demand/#Data_Transfer).