AWS datasync documentation change
Summary
Updated documentation to clarify when a DataSync agent is required (only for EFS/FSx transfers or Basic mode tasks), added Secrets Manager integration for SAS token storage, restructured location creation steps, and added authentication options for public datasets
Security assessment
The changes introduce integration with AWS Secrets Manager for credential storage (security best practice) and clarify authentication requirements. However, there's no evidence of addressing a specific security vulnerability. The updates improve security documentation by promoting secure credential management.
Diff
diff --git a/datasync/latest/userguide/creating-azure-blob-location.md b/datasync/latest/userguide/creating-azure-blob-location.md index 4d5edfd3b..4de61fc82 100644 --- a//datasync/latest/userguide/creating-azure-blob-location.md +++ b//datasync/latest/userguide/creating-azure-blob-location.md @@ -5 +5 @@ -Providing DataSync access to your Azure Blob StorageConsiderations with Azure Blob Storage transfersCreating your DataSync agentCreating your Azure Blob Storage transfer locationViewing your Azure Blob Storage transfer locationUpdating your Azure Blob Storage transfer locationNext steps +Providing DataSync access to your Azure Blob StorageConsiderations with Azure Blob Storage transfersCreating your DataSync agent (optional)Creating your Azure Blob Storage transfer locationViewing your Azure Blob Storage transfer locationUpdating your Azure Blob Storage transfer locationNext steps @@ -26 +26 @@ With AWS DataSync, you can transfer data between Microsoft Azure Blob Storage (i -To set up this kind of transfer, you create a [location](./how-datasync-transfer-works.html#sync-locations) for your Azure Blob Storage. You can use this location as a transfer source or destination. +To set up this kind of transfer, you create a [location](./how-datasync-transfer-works.html#sync-locations) for your Azure Blob Storage. You can use this location as a transfer source or destination. A DataSync agent is required only when transferring data between Azure Blob and Amazon EFS or Amazon FSx, or when using **Basic** mode tasks. You don't need an agent to transfer data between Azure Blob and Amazon S3 using **Enhanced** mode. @@ -184 +184 @@ The fees associated with moving data in or out of Azure Blob Storage can include - * Running an [Azure virtual machine (VM)](https://azure.microsoft.com/en-us/pricing/details/virtual-machines/linux/) (if you deploy your DataSync agent in Azure) + * Running an [Azure virtual machine (VM)](https://azure.microsoft.com/en-us/pricing/details/virtual-machines/linux/) (if you deploy a DataSync agent in Azure) @@ -186 +186 @@ The fees associated with moving data in or out of Azure Blob Storage can include - * Running an [Amazon EC2](https://aws.amazon.com/ec2/pricing/) instance (if you deploy your DataSync agent in a VPC within AWS) + * Running an [Amazon EC2](https://aws.amazon.com/ec2/pricing/) instance (if you deploy a DataSync agent in a VPC within AWS) @@ -245 +245 @@ Remember the following limitations when transferring data to or from Azure Blob -## Creating your DataSync agent +## Creating your DataSync agent (optional) @@ -247 +247 @@ Remember the following limitations when transferring data to or from Azure Blob -To get started, you must create a DataSync agent that can connect to your Azure Blob Storage container. This process includes deploying and activating an agent. +A DataSync agent is required only when transferring data between Azure Blob and Amazon EFS or Amazon FSx, or when using **Basic** mode tasks. You don't need an agent to transfer data between Azure Blob and Amazon S3 using **Enhanced** mode. This section describes how to deploy and activate an agent. @@ -531 +531 @@ Make sure that you know how DataSync accesses Azure Blob Storage and works with - 4. For **Agents** , choose the DataSync agent that can connect with your Azure Blob Storage container. + 4. For **Container URL** , enter the URL of the container that's involved in your transfer. @@ -533 +533 @@ Make sure that you know how DataSync accesses Azure Blob Storage and works with -You can choose more than one agent. For more information, see [Using multiple DataSync agents](./do-i-need-datasync-agent.html#multiple-agents). + 5. (Optional) For **Access tier when used as a destination** , choose the access tier that you want your objects or files transferred into. @@ -535 +535 @@ You can choose more than one agent. For more information, see [Using multiple Da - 5. For **Container URL** , enter the URL of the container that's involved in your transfer. + 6. For **Folder** , enter path segments if you want to limit your transfer to a virtual directory in your container (for example, `/my/images`). @@ -537 +537 @@ You can choose more than one agent. For more information, see [Using multiple Da - 6. (Optional) For **Access tier when used as a destination** , choose the access tier that you want your objects or files transferred into. + 7. If your transfer requires an agent, choose **Use agents** , then choose the DataSync agent that can connect with your Azure Blob Storage container. @@ -539 +539 @@ You can choose more than one agent. For more information, see [Using multiple Da - 7. For **Folder** , enter path segments if you want to limit your transfer to a virtual directory in your container (for example, `/my/images`). + 8. For **SAS token** , provide the credentials necessary for DataSync to access your blob storage. Some public datasets on Azure Blob storage do not require credentials. You can enter a SAS token directly, or specify an AWS Secrets Manager secret that contains the token. For more information, see [Providing credentials for storage locations](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html). @@ -541,3 +541 @@ You can choose more than one agent. For more information, see [Using multiple Da - 8. For **SAS token** , enter the SAS token that allows DataSync to access your blob storage. - -The token is part of the SAS URI string that comes after the storage resource URI and a question mark (`?`). A token looks something like this: +Your SAS token is part of the SAS URI string that comes after your storage resource URI and a question mark (`?`). A token looks something like this: @@ -571 +569 @@ Tags help you manage, filter, and search for your AWS resources. We recommend cr - 3. For the `--authentication-type` parameter, specify `SAS`. + 3. For the `--authentication-type` parameter, specify `SAS`. If you are accessing a public dataset that does not require authentication, specify `NONE`. @@ -575 +573,3 @@ Tags help you manage, filter, and search for your AWS resources. We recommend cr -The token is part of the SAS URI string that comes after the storage resource URI and a question mark (`?`). A token looks something like this: +You can also provide additional parameters for securing your keys using AWS Secrets Manager. For more information, see [Providing credentials for storage locations](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html). + +Your SAS token is part of the SAS URI string that comes after your storage resource URI and a question mark (`?`). A token looks something like this: @@ -579 +579 @@ The token is part of the SAS URI string that comes after the storage resource UR - 5. For the `--agent-arns` parameter, specify the Amazon Resource Name (ARN) of the DataSync agent that can connect to your container. + 5. (Optional) For the `--agent-arns` parameter, specify the Amazon Resource Name (ARN) of the DataSync agent that can connect to your container.