AWS drs medium security documentation change
Summary
Updated security group documentation to emphasize automatic monitoring/enforcement of default group rules, clarify recommended practices, and restructure guidance about security group selection
Security assessment
The changes explicitly describe security monitoring capabilities (constant rule enforcement checks) and automatic remediation of security group configuration changes. This addresses potential security risks from misconfigured security groups that could disrupt replication or expose services. The emphasis on mandatory retention of the default security group for operations also has security implications.
Diff
diff --git a/drs/latest/userguide/drs-security-group.md b/drs/latest/userguide/drs-security-group.md index 52fcb4911..694561c70 100644 --- a//drs/latest/userguide/drs-security-group.md +++ b//drs/latest/userguide/drs-security-group.md @@ -7 +7 @@ -A security group acts as a virtual firewall, which controls the inbound and outbound traffic of the staging area. The best practice is to have AWS Elastic Disaster Recovery automatically attach and monitor the default AWS Elastic Disaster Recovery security group. This group opens inbound TCP Port 1500 for receiving the transferred replicated data. +A security group acts as a virtual firewall, which controls the inbound and outbound traffic of the staging area. We recommend that you have AWS Elastic Disaster Recovery automatically attach and monitor the default Elastic Disaster Recovery security group. This group opens inbound TCP Port 1500 for receiving the transferred replicated data. When you use the default DRS; security group Elastic Disaster Recovery constantly monitors whether the rules within this security group are enforced, in order to maintain uninterrupted data replication. If these rules are altered, Elastic Disaster Recovery automatically fixes the issue. Choose: @@ -9 +9 @@ A security group acts as a virtual firewall, which controls the inbound and outb -Choose whether you would like to **Always use the AWS Elastic Disaster Recovery security group**. + * Recommended - Select **Always use AWS Elastic Disaster Recovery security group** to allow data to flow from your source servers to the replication servers, and so that the replication servers can communicate their state to the AWS Elastic Disaster Recovery servers. @@ -11 +11 @@ Choose whether you would like to **Always use the AWS Elastic Disaster Recovery - + * Not recommended - Deselect **Always use AWS Elastic Disaster Recovery security group** option. Then, select the drop-down menu to choose from the list of available security groups. The list of available security groups changes according to the **Staging area subnet** that you selected. @@ -13 +13 @@ Choose whether you would like to **Always use the AWS Elastic Disaster Recovery -The best practice is to have AWS Elastic Disaster Recovery automatically attach and monitor the default AWS Elastic Disaster Recovery security group. This group opens inbound TCP Port 1500 for receiving the transferred replicated data. When the default AWS Elastic Disaster Recovery security group is used, AWS Elastic Disaster Recovery will constantly monitor whether the rules within this security group are enforced, in order to maintain uninterrupted data replication. If these rules are altered, AWS Elastic Disaster Recovery will automatically fix the issue. + * To search for a specific security group, use the search box. @@ -15 +15 @@ The best practice is to have AWS Elastic Disaster Recovery automatically attach -Choose the box next to the **Always use AWS Elastic Disaster Recovery security group** option to allow data to flow from your source servers to the replication servers, and that the replication servers can communicate their state to the AWS Elastic Disaster Recovery servers. + * If you add security groups via the AWS Console, they appear on the Security group drop-down list in the AWS Elastic Disaster Recovery Console. Learn more about AWS security groups in [this VPC article](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html). @@ -17 +17 @@ Choose the box next to the **Always use AWS Elastic Disaster Recovery security g -Otherwise, deselect the box next to the **Always use AWS Elastic Disaster Recovery security group** option. Doing this is not recommended. + * Any security group that you select is added to the default AWS Elastic Disaster Recovery group, because the default security group is essential for the operation of AWS Elastic Disaster Recovery. @@ -19 +18,0 @@ Otherwise, deselect the box next to the **Always use AWS Elastic Disaster Recove -Click the drop-down menu to select from additional security groups. The list of available security groups changes according to the **Staging area subnet** you selected. @@ -21 +19,0 @@ Click the drop-down menu to select from additional security groups. The list of -To search for a specific security group, use the search box. @@ -23,3 +20,0 @@ To search for a specific security group, use the search box. -If you add security groups via the AWS Console, they will appear on the Security group drop-down list in the AWS Elastic Disaster Recovery Console. Learn more about AWS security groups in [this VPC article](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html). - -You can use the default AWS Elastic Disaster Recovery security group or select a different one. However, take into consideration that any selected security group that is not the AWS Elastic Disaster Recovery default will be added to the Default group, since the default security group is essential for the operation of AWS Elastic Disaster Recovery.