AWS solutions documentation change
Summary
Updated terminology from 'solution' to 'guidance', restructured component descriptions with numbered lists, added identity provider references in ALB description, and reorganized security-related AWS services section.
Security assessment
The changes include explicit mentions of identity providers (OIDS/LDAP) in the ALB context and retain/expand documentation about AWS WAF protection, Secrets Manager usage, and bastion host hardening. While these clarify security practices, there is no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/solutions/latest/scalable-analytics-using-apache-druid-on-aws/architecture-overview.md b/solutions/latest/scalable-analytics-using-apache-druid-on-aws/architecture-overview.md index e841b418b..a43033025 100644 --- a//solutions/latest/scalable-analytics-using-apache-druid-on-aws/architecture-overview.md +++ b//solutions/latest/scalable-analytics-using-apache-druid-on-aws/architecture-overview.md @@ -3 +3 @@ -[Documentation](/index.html)[Scalable Analytics Using Apache Druid on AWS](https://aws.amazon.com/solutions/implementations/scalable-analytics-using-apache-druid-on-aws)[Implementation Guide](solution-overview.html) +[Documentation](/index.html)[Guidance for Scalable Analytics Using Apache Druid on AWS](https://aws.amazon.com/solutions/guidance/scalable-analytics-using-apache-druid-on-aws)[Implementation Guide](solution-overview.html) @@ -9 +9 @@ Architecture diagram -This section provides a reference implementation architecture diagram for the components deployed with this solution. +This section provides a reference implementation architecture diagram for the components deployed with this guidance. @@ -13 +13 @@ This section provides a reference implementation architecture diagram for the co -Deploying this solution with the default parameters deploys the following components in your AWS account. +Deploying this guidance with the default parameters deploys the following components in your AWS account. @@ -15 +15 @@ Deploying this solution with the default parameters deploys the following compon -**Scalable Analytics using Apache Druid on AWS - Architecture diagram** +**Guidance for Scalable Analytics Using Apache Druid on AWS - Architecture diagram** @@ -17 +17 @@ Deploying this solution with the default parameters deploys the following compon - + @@ -23 +23 @@ AWS CloudFormation resources are created from AWS Cloud Development Kit (AWS CDK -The high-level process flow for the solution components deployed with the AWS CDK constructs is as follows. The numbers and description matches the number designated in the following architecture diagram. +The high-level process flow for the guidance components deployed with the AWS CDK constructs is as follows. The numbers and description matches the number designated in the following architecture diagram. @@ -25 +25 @@ The high-level process flow for the solution components deployed with the AWS CD -The solution deploys the following components that work together to provide a production-ready Druid cluster: +The guidance deploys the following components that work together to provide a production-ready Druid cluster: @@ -27 +27 @@ The solution deploys the following components that work together to provide a pr - * [AWS Web Application Firewall (AWS WAF)](https://aws.amazon.com/waf/) to protect the Druid web console and Druid API endpoints against common web exploits and bots that may affect availability, compromise security, or consume excessive resources. AWS WAF is only provisioned and deployed for internet facing clusters. + 1. AWS WAF protects the Druid web console and Druid API endpoints against common web exploits and bots that may affect availability, compromise security, or consume excessive resources. AWS WAF is only provisioned and deployed for internet facing clusters. @@ -29 +29 @@ The solution deploys the following components that work together to provide a pr - * A security hardened Linux server (Bastion host) to manage access to the Druid servers running in a private network separate from an external network. It can also be used to access the Druid web console through SSH tunneling where a private [Application Load Balancer (ALB)](https://aws.amazon.com/alb/) is deployed. + 2. A security hardened Linux server (Bastion host) manages access to the Druid servers running in a private network separate from an external network. It can also be used to access the Druid web console through SSH tunneling, where a private Application Load Balancer (ALB) is deployed. @@ -31 +31 @@ The solution deploys the following components that work together to provide a pr - * An ALB serves as the single point of contact for clients. The load balancer distributes incoming application traffic across multiple query servers in multiple Availability Zones. **.** A private subnet consisting of: + 3. ALB serves as the single point of contact for clients. The load balancer distributes incoming application traffic from identity providers—such as object identifiers (OIDS) and lightweight directory access protocol (LDAP)—across multiple query servers in multiple Availability Zones. @@ -33 +33 @@ The solution deploys the following components that work together to provide a pr - * **Druid master Auto scaling group** : An Auto scaling group contains a collection of Druid master servers. A Master server manages data ingestion and availability and is responsible for starting new ingestion jobs and coordinating availability of data on the data servers. Within a Master server, functionality is split between two processes: the Coordinator and Overlord. + 4. The private subnet consists of the following: @@ -35 +35 @@ The solution deploys the following components that work together to provide a pr - * **Druid data Auto scaling group** : An Auto scaling group contains a collection of Druid data servers. A data server runs ingestion jobs and stores queryable data. Within a data server, functionality is split between two processes: the Historical and MiddleManager. + * The Druid Master Auto Scaling group contains a collection of Druid master servers. A master server manages data ingestion and availability and is responsible for starting new ingestion jobs and coordinating availability of data on the data servers. Within a master server, functionality is split between two processes: the Coordinator and Overlord. @@ -37 +37 @@ The solution deploys the following components that work together to provide a pr - * **Druid query Auto scaling group** : An Auto scaling group contains a collection of Druid query servers. A query server provides the endpoints that users and client applications interact with, routing queries to data servers or other query servers. Within a Query server, functionality is split between two processes: the Broker and Router. + * The Druid Data Auto scaling group contains a collection of Druid data servers. A data server runs ingestion jobs and stores queryable data. Within a data server, functionality is split between two processes: the Historical and MiddleManager. @@ -39 +39 @@ The solution deploys the following components that work together to provide a pr - * **ZooKeeper Auto scaling group** : An Auto scaling group contains a collection of ZooKeeper servers. Apache Druid uses [Apache ZooKeeper](https://zookeeper.apache.org/) (ZK) for management of current cluster state. + * The Druid Query Auto scaling group contains a collection of Druid query servers. A query server provides the endpoints that users and client applications interact with, routing queries to data servers or other query servers. Within a query server, functionality is split between two processes; the Broker and Router. @@ -41 +41 @@ The solution deploys the following components that work together to provide a pr - * An [Amazon Simple Storage Service](https://aws.amazon.com/s3/) (Amazon S3) bucket provides deep storage for the Apache Druid cluster. Deep storage is the location where the segments are stored. + * The ZooKeeper Auto Scaling group contains a collection of ZooKeeper servers. Apache Druid uses Apache ZooKeeper for management of current cluster state.The ZooKeeper Auto Scaling group contains a collection of ZooKeeper servers. Apache Druid uses Apache ZooKeeper for management of current cluster state. @@ -43 +42,0 @@ The solution deploys the following components that work together to provide a pr - * [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) stores the secrets used by Apache Druid including the RDS secret, and the administrator secret. It also stores the credentials for the system account the Druid components use to authenticate with each other. @@ -45 +43,0 @@ The solution deploys the following components that work together to provide a pr - * [Amazon CloudWatch](https://aws.amazon.com/cloudwatch/) support logs, metrics, and dashboards. @@ -47 +44,0 @@ The solution deploys the following components that work together to provide a pr - * An [Amazon Aurora](https://aws.amazon.com/rds/aurora/) PostgreSQL database provides the metadata storage for the Apache Druid cluster. Druid uses the metadata store to house only metadata about the system only, and does not store the actual data. @@ -49 +46,9 @@ The solution deploys the following components that work together to provide a pr - * The notification system, powered by [Amazon Simple Notification Service](https://aws.amazon.com/sns/) (Amazon SNS), delivers alerts or alarms promptly when system events occur. This ensures immediate awareness and action when needed. + 1. An Amazon Simple Storage Service (Amazon S3) bucket provides deep storage for the Apache Druid cluster. Deep storage is the location where the segments are stored. + + 2. AWS Secrets Manager stores the secrets used by Apache Druid, including the Amazon Relational Database Service (Amazon RDS) secret and the administrator user secret. It also stores the credentials for the system account the Druid components use to authenticate with each other. + + 3. Amazon CloudWatch supports logs, metrics, and dashboards. + + 4. An Amazon Aurora PostgreSQL database provides the metadata storage for the Apache Druid cluster. Druid uses the metadata store to house only metadata about the system and does not store the actual data. + + 5. The notification system, powered by Amazon Simple Notification Service (Amazon SNS), delivers alerts or alarms promptly when system events occur. This helps ensure immediate awareness and action when needed.