AWS datasync medium security documentation change
Summary
Updated documentation to clarify agent requirements based on transfer mode (Basic/Enhanced), added Secrets Manager integration for HMAC keys, and reorganized location configuration steps
Security assessment
The change introduces AWS Secrets Manager integration for storing HMAC key secrets ('Providing credentials for storage locations' reference), which improves security by encouraging secure credential management rather than direct secret entry. This directly addresses credential handling security best practices.
Diff
diff --git a/datasync/latest/userguide/tutorial_transfer-google-cloud-storage.md b/datasync/latest/userguide/tutorial_transfer-google-cloud-storage.md index 571b83a91..f59521a13 100644 --- a//datasync/latest/userguide/tutorial_transfer-google-cloud-storage.md +++ b//datasync/latest/userguide/tutorial_transfer-google-cloud-storage.md @@ -5 +5 @@ -OverviewCostsPrerequisitesCreating an HMAC key for your Google Cloud Storage bucketStep 2: Configure your networkStep 3: Create a DataSync agentStep 4: Create a DataSync source location for your Google Cloud Storage bucketStep 5: Create a DataSync destination location for your S3 bucketStep 6: Create and start a DataSync task +OverviewCostsPrerequisitesCreating an HMAC key for your Google Cloud Storage bucketStep 2: Configure your networkStep 3: Create a DataSync agent (optional)Step 4: Create a DataSync source location for your Google Cloud Storage bucketStep 5: Create a DataSync destination location for your S3 bucketStep 6: Create and start a DataSync task @@ -9 +9 @@ OverviewCostsPrerequisitesCreating an HMAC key for your Google Cloud Storage buc -The following tutorial shows how you can use AWS DataSync to migrate objects from a Google Cloud Storage bucket to an Amazon S3 bucket. +The following tutorial shows how you can use AWS DataSync to migrate objects from a Google Cloud Storage (GCS) bucket to an Amazon S3 bucket. @@ -13 +13,5 @@ The following tutorial shows how you can use AWS DataSync to migrate objects fro -Because DataSync integrates with the [Google Cloud Storage XML API](https://cloud.google.com/storage/docs/xml-api/overview), you can copy objects into Amazon S3 without writing code. How this works depends on where you deploy the DataSync agent that facilitates the transfer. +DataSync uses the [Google Cloud Storage XML API](https://cloud.google.com/storage/docs/xml-api/overview) for data transfers. This API provides an Amazon S3-compatible interface for reading and writing data with GCS buckets. + +DataSync supports transfers between GCS and AWS storage services. When copying between GCS and Amazon EFS or Amazon FSx, an agent is required and your task must use **Basic** mode. When copying between GCS and Amazon S3, an agent is only required when using **Basic** mode. + +If you use an agent for your transfer, then you can deploy the agent in Google Cloud or in your Amazon VPC. @@ -53 +57 @@ The following diagram illustrates the transfer. -The fees associated with this migration include: +The fees associated with this migration might include: @@ -100 +104 @@ You'll need these items later to configure your DataSync source location. -The network requirements for this migration depend on how you want to deploy your DataSync agent. +Network configuration is required only when using a DataSync agent with your transfer. The network requirements for this migration depend on where you choose to deploy your agent. @@ -121 +125 @@ To do this, modify the [security group](https://docs.aws.amazon.com/vpc/latest/u -## Step 3: Create a DataSync agent +## Step 3: Create a DataSync agent (optional) @@ -123 +127 @@ To do this, modify the [security group](https://docs.aws.amazon.com/vpc/latest/u -You need a DataSync agent that can access and read your Google Cloud Storage bucket. +A DataSync agent is only required when using **Basic** mode tasks. If you are using **Enhanced** mode to transfer between Google Cloud Storage (GCS) and Amazon S3, then no agent is required. If you want to use **Basic** mode, then you need a DataSync agent that can access your GCS bucket. @@ -245 +249,5 @@ To set up a DataSync location for your Google Cloud Storage bucket, you need the - 4. For **Agents** , choose the agent that you created in Step 3. + 4. For **Server** , enter `storage.googleapis.com`. + + 5. For **Bucket name** , enter the name of your Google Cloud Storage bucket. + + 6. For **Folder** , enter an object prefix. @@ -247 +255 @@ To set up a DataSync location for your Google Cloud Storage bucket, you need the - 5. For **Server** , enter `storage.googleapis.com`. +DataSync only copies objects with this prefix. @@ -249 +257 @@ To set up a DataSync location for your Google Cloud Storage bucket, you need the - 6. For **Bucket name** , enter the name of your Google Cloud Storage bucket. + 7. If your transfer requires an agent, choose **Use agents** , then choose the agent that you created in Step 3. @@ -251 +259 @@ To set up a DataSync location for your Google Cloud Storage bucket, you need the - 7. Expand **Additional settings**. For **Server protocol** , choose **HTTPS**. For **Server port** , choose **443**. + 8. Expand **Additional settings**. For **Server protocol** , choose **HTTPS**. For **Server port** , choose **443**. @@ -253 +261 @@ To set up a DataSync location for your Google Cloud Storage bucket, you need the - 8. Scroll down to the **Authentication** section. Make sure that the **Requires credentials** check box is selected, and then do the following: + 9. Scroll down to the **Authentication** section. Make sure that the **Requires credentials** check box is selected, and then do the following: @@ -257 +265 @@ To set up a DataSync location for your Google Cloud Storage bucket, you need the - * For **Secret key** , enter your HMAC key's secret. + * For **Secret key** , either enter your HMAC key's secret key directly, or specify an AWS Secrets Manager secret that contains the key. For more information, see [Providing credentials for storage locations](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html). @@ -259 +267 @@ To set up a DataSync location for your Google Cloud Storage bucket, you need the - 9. Choose **Create location**. + 10. Choose **Create location**. @@ -309 +317 @@ With your source and destinations locations configured, you can start moving you -Because DataSync communicates with Google Cloud Storage by using the Amazon S3 API, there's a limitation that might cause your DataSync task to fail if you try to copy object tags. +Because the Google Cloud Storage XML API does not support reading or writing object tags, your DataSync task might fail if you try to copy object tags. @@ -332 +340 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Transferring to or from other cloud storage +Planning transfers to or from third-party cloud storage systems