AWS drs documentation change
Summary
Restructured EBS volume configuration documentation with clarified encryption settings, removed images, and added details about KMS key usage for encryption. Added guidance for automatic replication of new disks.
Security assessment
The changes explicitly document encryption configuration options (including cross-account KMS keys) and emphasize encryption at rest for replicated data. While this improves security documentation, there is no evidence of addressing a specific vulnerability or security incident. The updates provide clearer guidance on secure configurations rather than patching a security issue.
Diff
diff --git a/drs/latest/userguide/volumes-drs.md b/drs/latest/userguide/volumes-drs.md index ef97fb6ac..46683891e 100644 --- a//drs/latest/userguide/volumes-drs.md +++ b//drs/latest/userguide/volumes-drs.md @@ -9,3 +9 @@ Amazon EBS volume typeAmazon EBS encryptionAutomatic replication of new disks -Determine the default Amazon EBS volume type to be used by the replication servers and whether to use Amazon EBS encryption. - - +Set the default Amazon EBS volume type used by the replication servers, whether to use Amazon EBS encryption, and whether to automatically replicate newly added disks. @@ -15,3 +13 @@ Determine the default Amazon EBS volume type to be used by the replication serve -Choose the default **Amazon EBS volume type** to be used by the replication servers for large disks. - - +Each disk has minimum and maximum sizes and varying performance metrics and pricing. Learn more about Amazon EBS volume types in [this Amazon EBS article](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html). The best practice is to not change the default **Auto volume type selection** volume type, unless there is a business need for doing so. @@ -19 +15 @@ Choose the default **Amazon EBS volume type** to be used by the replication serv -When choosing **Auto volume type selection** the service will dynamically switch between performance/cost optimized volume type according to the replicated disk write throughput. +Choose the default **Amazon EBS volume type** to be used by the replication servers for large disks: @@ -21,3 +17 @@ When choosing **Auto volume type selection** the service will dynamically switch -Each disk has minimum and maximum sizes and varying performance metrics and pricing. Learn more about Amazon EBS volume types in [this Amazon EBS article](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html). - -The best practice is to not change the default **Auto volume type selection** volume type, unless there is a business need for doing so. + * With **Auto volume type selection** the service dynamically switches between performance/cost optimized volume type according to the replicated disk write throughput. @@ -29,3 +23 @@ This option only affects disks over 125 GiB (by default, smaller disks always us -The default **Lower cost, Throughput Optimized HDD (st1)** option utilizes slower, less expensive disks. - - + * The default **Lower cost, Throughput Optimized HDD (st1)** option utilizes slower, less expensive disks. @@ -39,6 +31 @@ You may want to use this option if: - * You are not concerned with how long the Initial Sync process will take - - - - -The **Faster, General Purpose SSD (gp2)** and Faster, **General Purpose SSD (gp3)** options utilizes faster, but more expensive disks. + * You are not concerned with how long the Initial Sync process takes @@ -46 +33 @@ The **Faster, General Purpose SSD (gp2)** and Faster, **General Purpose SSD (gp3 - + * The **Faster, General Purpose SSD (gp2)** and Faster, **General Purpose SSD (gp3)** options utilizes faster, but more expensive disks. @@ -65 +52 @@ You can customize the Amazon EBS volume type used by each disk within each sourc -Choose whether to use the default or custom Amazon **EBS encryption** , or select none to have no encryption. The option none, will not encrypt the replicated data at rest on staging area subnet disks and replicated disks. The options default or custom will encrypt your replicated data at rest on the staging area subnet disks and the replicated disks. +Choose your encryption approach: @@ -67 +54 @@ Choose whether to use the default or custom Amazon **EBS encryption** , or selec -Choose whether to use the default Amazon EBS encryption Volume Encryption Key, or enter a custom customer-managed key in the regular key ID format. If you choose the **Default** option, the default key is used (which can be an EBS-managed key or a customer-managed key). + * When you choose **Default** , the default key is used. This can be an EBS-managed key or a customer-managed key. This option encrypts your replicated data at rest on the staging area subnet disks and the replicated disks. @@ -69 +56 @@ Choose whether to use the default Amazon EBS encryption Volume Encryption Key, o - + * Choose **Custom** and then enter the ARN or key ID of a customer-managed key from your account or another AWS account in the **EBS encryption key** field. Enter the key, such as a cross-account KMS key, in standard key ID format. For example, KMS key format is `123abcd-12ab-34cd-56ef-1234567890ab)`. This option encrypts your replicated data at rest on the staging area subnet disks and the replicated disks. @@ -71 +58 @@ Choose whether to use the default Amazon EBS encryption Volume Encryption Key, o -If the **Custom** option is chosen, the **EBS encryption key** box will appear. Enter the ARN or key ID of a customer-managed key from your account or another AWS account. Enter the encryption key (such as a cross-account KMS key) in the regular key ID format (KMS key example: 123abcd-12ab-34cd-56ef-1234567890ab). + * Choose **Create an AWS KMS key** to be redirected to the Key Management Service (KMS) Console where you can create a new key to use. @@ -73 +59,0 @@ If the **Custom** option is chosen, the **EBS encryption key** box will appear. - @@ -75 +60,0 @@ If the **Custom** option is chosen, the **EBS encryption key** box will appear. -To create a new AWS KMS key, click **Create an AWS KMS key**. You will be redirected to the Key Management Service (KMS) Console where you can create a new key to use. @@ -77 +61,0 @@ To create a new AWS KMS key, click **Create an AWS KMS key**. You will be redire - @@ -79 +63 @@ To create a new AWS KMS key, click **Create an AWS KMS key**. You will be redire -Learn more about EBS Volume Encryption in [this Amazon EBS article](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html). +Learn more about EBS Volume Encryption in [Amazon EBS encyption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html). @@ -83 +67 @@ Learn more about EBS Volume Encryption in [this Amazon EBS article](https://docs -Reversing the encryption option after data replication has started will cause data replication to start from the beginning. +Changing the encryption option after data replication has started causes data replication to start from the beginning. @@ -87 +71 @@ Reversing the encryption option after data replication has started will cause da -AWS Elastic Disaster Recovery (AWS DRS) allows you to automatically replicate newly added disks. When new disks are added to your source environment, AWS DRS initiates data replication to the staging area subnet in your AWS account. +AWS Elastic Disaster Recovery (AWS DRS) allows you to automatically replicate newly added disks. When you add new disks to your source environment AWS DRS initiates data replication to the staging area subnet in your AWS account. @@ -97 +81 @@ To deactivate or reactivate this feature for newly added servers: - * Click **Edit**. + * select **Edit**. @@ -108 +92 @@ To activate or deactivate or reactivate this feature for a specific server: - * Click **Edit**. + * select **Edit**. @@ -123 +107 @@ To activate or deactivate or reactivate this feature for a specific server: - * New disks will only be replicated once the feature is activated and will not be replicated retroactively. + * New disks are only replicated once the feature is activated and are not replicated retroactively.