AWS drs documentation change
Summary
Updated data routing documentation with restructured content about private IP usage, encryption details, and bandwidth throttling. Added explicit security benefits of private IP routing and clarified public/private IP behavior.
Security assessment
The changes explicitly mention that using private IPs adds 'another layer of security' and emphasize data is 'always encrypted in transit'. While this describes security features, there is no evidence of addressing a specific vulnerability or incident. The updates improve documentation of existing security controls rather than patching a weakness.
Diff
diff --git a/drs/latest/userguide/data-routing.md b/drs/latest/userguide/data-routing.md index b8ec26067..c9789a81d 100644 --- a//drs/latest/userguide/data-routing.md +++ b//drs/latest/userguide/data-routing.md @@ -5 +5 @@ -Use private IP for data replicationThrottle network bandwidth +Throttle network bandwidth @@ -9 +9 @@ Use private IP for data replicationThrottle network bandwidth -AWS Elastic Disaster Recovery lets you control how data is routed from your source servers to the replication servers on AWS through the **Data routing and throttling** settings. +AWS Elastic Disaster Recovery lets you control how data is routed from your source servers to the replication servers on AWS through the **Data routing and throttling** settings. By default, data is sent from the source servers to the replication servers over the public internet, using the public IP that was automatically assigned to the replication servers. Transferred data is always encrypted in transit. Choose **Use private IP for data replication...** if you want to route the replicated data from your source servers to the staging area subnet through a private network with a VPN, AWS Direct Connect, VPC peering, or another type of existing private connection. Data replication does not work unless you have already set up the VPN, AWS Direct Connect, or VPC peering in the AWS Console. Usee this option if you want to: @@ -11,3 +11 @@ AWS Elastic Disaster Recovery lets you control how data is routed from your sour - - -By default, data is sent from the source servers to the replication servers over the public internet, using the public IP that was automatically assigned to the replication servers. Transferred data is always encrypted in transit. + * Allocate a dedicated bandwidth for replication; @@ -15 +13 @@ By default, data is sent from the source servers to the replication servers over -## Use private IP for data replication + * Use another level of encryption; @@ -17 +15 @@ By default, data is sent from the source servers to the replication servers over -Choose the box to the left of the **Use private IP for data replication...** option if you want to route the replicated data from your source servers to the staging area subnet through a private network with a VPN, AWS Direct Connect, VPC peering, or another type of existing private connection. + * Add another layer of security by transferring the replicated data from one private IP address (source) to another private IP address (on AWS). @@ -19 +16,0 @@ Choose the box to the left of the **Use private IP for data replication...** opt -Do not choose the box to the left of the **Use private IP for data replication...** if you do not want to route the replicated data through a private network. @@ -21 +17,0 @@ Do not choose the box to the left of the **Use private IP for data replication.. -###### Important @@ -23 +18,0 @@ Do not choose the box to the left of the **Use private IP for data replication.. -Data replication will not work unless you have already set up the VPN, AWS Direct Connect, or VPC peering in the AWS Console. @@ -27 +22 @@ Data replication will not work unless you have already set up the VPN, AWS Direc - * If you selected the Default subnet, it is highly unlikely that the Private IP is used for that Subnet. Ensure that Private IP (VPN, AWS Direct Connect, or VPC peering) is used for your chosen subnet if you wish to use this option. + * If you selected the Default subnet, it is unlikely that the Private IP is used for that Subnet. Ensure that Private IP (VPN, AWS Direct Connect, or VPC peering) is used for your chosen subnet if you use this option. @@ -29 +24 @@ Data replication will not work unless you have already set up the VPN, AWS Direc - * You can safely switch between a private connection and a public connection for individual server settings by choosing or not choosing the box to the left of the **Use private IP for data replication....** option , even after data replication has begun. This switch will only cause a short pause in replication, and will not have any long-term effect on the replication. + * You can safely select and deselect **Use private IP for data replication....** even after data replication has begun. This switch causes a short pause in replication, and does not have long-term effects on the replication. @@ -31 +26 @@ Data replication will not work unless you have already set up the VPN, AWS Direc - * Choosing the **Use Private IP for data replication...** option will not create a new private connection. + * Choosing the **Use Private IP for data replication...** option does not create a new private connection. @@ -32,0 +28 @@ Data replication will not work unless you have already set up the VPN, AWS Direc + * When you select the **Use private IP** option, you choose to **Create public IP**. Public IPs are used by default. @@ -36,14 +31,0 @@ Data replication will not work unless you have already set up the VPN, AWS Direc -You should use this option if you want to: - - * Allocate a dedicated bandwidth for replication; - - * Use another level of encryption; - - * Add another layer of security by transferring the replicated data from one private IP address (source) to another private IP address (on AWS). - - - - -### Create public IP - -When you select the **Use private IP** option, you choose to **Create public IP**. Public IPs are used by default. @@ -53,5 +35 @@ When you select the **Use private IP** option, you choose to **Create public IP* -You can control the amount of network bandwidth used for data replication per server. By default, AWS Elastic Disaster Recovery will use all available network bandwidth utilizing five concurrent connections. - -Choose the box to the left of the **Throttle network bandwidth...** option if you want to control the transfer rate of data sent from your source servers to the replication servers over TCP Port 1500. - - +You can control the amount of network bandwidth used for data replication per server. By default, AWS Elastic Disaster Recovery uses all available network bandwidth over five concurrent connections. @@ -59 +37 @@ Choose the box to the left of the **Throttle network bandwidth...** option if yo -If you activate the **Throttle network bandwidth** option, then the bandwidth field will appear. Enter your desired bandwidth in Mbps. +Choose **Throttle network bandwidth...** to control the transfer rate of data sent from your source servers to the replication servers over TCP Port 1500. Enter the bandwidth in Mpbs in the bandwidth field