AWS solutions documentation change
Summary
Updated terminology from 'solution' to 'guidance' throughout documentation, changed implementation references to guidance references, and adjusted deployment terminology
Security assessment
The changes are primarily terminology updates (solution -> guidance) without modifying security configurations. Existing security-related content about TLS, FIPS 140-2, IAM roles, and authentication mechanisms remains unchanged in substance. No new security vulnerabilities or mitigations are introduced.
Diff
diff --git a/solutions/latest/scalable-analytics-using-apache-druid-on-aws/configure-the-solution.md b/solutions/latest/scalable-analytics-using-apache-druid-on-aws/configure-the-solution.md index e7697348a..d9bf819a4 100644 --- a//solutions/latest/scalable-analytics-using-apache-druid-on-aws/configure-the-solution.md +++ b//solutions/latest/scalable-analytics-using-apache-druid-on-aws/configure-the-solution.md @@ -3 +3 @@ -[Documentation](/index.html)[Scalable Analytics Using Apache Druid on AWS](https://aws.amazon.com/solutions/implementations/scalable-analytics-using-apache-druid-on-aws)[Implementation Guide](solution-overview.html) +[Documentation](/index.html)[Guidance for Scalable Analytics Using Apache Druid on AWS](https://aws.amazon.com/solutions/guidance/scalable-analytics-using-apache-druid-on-aws)[Implementation Guide](solution-overview.html) @@ -7 +7 @@ Amazon Machine Images (AMI)Data retention policyNetworkDruid domainFIPS 140-2Ide -# Configure the solution +# Configure the guidance @@ -11 +11 @@ This section describes the various options that you configure for your use case -The following table lists the configuration, setting, and if the configuration is mandatory before you deploy the solution in your AWS account. +The following table lists the configuration, setting, and if the configuration is mandatory before you deploy the guidance in your AWS account. @@ -57 +57 @@ To override this, specify the `customAmi` object in the `cdk.json` file. This ob -The solution has been tested with Amazon Linux, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. +The guidance has been tested with Amazon Linux, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. @@ -73 +73 @@ The solution has been tested with Amazon Linux, Ubuntu 20.04 LTS and Ubuntu 22.0 -By default, all the solution data (S3 buckets, Aurora DB instances, Aurora DB snapshots etc.) is retained when you uninstall the solution. +By default, all the guidance data (S3 buckets, Aurora DB instances, Aurora DB snapshots etc.) is retained when you uninstall the guidance. @@ -75 +75 @@ By default, all the solution data (S3 buckets, Aurora DB instances, Aurora DB sn -To remove this data, in the configuration file, set the retainData flag to false. You are liable for the service charges when solution data is retained in the default configuration. +To remove this data, in the configuration file, set the retainData flag to false. You are liable for the service charges when guidance data is retained in the default configuration. @@ -84 +84 @@ To remove this data, in the configuration file, set the retainData flag to false - * VPC CIDR Range: By default, the solution creates a new VPC for deployment with 10.120.0.0/16 as the default CIDR range. You can override this using this configuration: + * VPC CIDR Range: By default, the guidance creates a new VPC for deployment with 10.120.0.0/16 as the default CIDR range. You can override this using this configuration: @@ -102 +102 @@ To remove this data, in the configuration file, set the retainData flag to false -The solution will provision an ALB to route requests to Druid query instances. It supports both internet facing and private options as follows. +The guidance will provision an ALB to route requests to Druid query instances. It supports both internet facing and private options as follows. @@ -118 +118 @@ You can launch a bastion host in the public subnet using this configuration, whi -This solution can integrate with Amazon Route 53 to automate the creation of domains, streamlining access to the Druid web console and API endpoints. +This guidance can integrate with Amazon Route 53 to automate the creation of domains, streamlining access to the Druid web console and API endpoints. @@ -120 +120 @@ This solution can integrate with Amazon Route 53 to automate the creation of dom -With the following Route 53 configuration, this solution automatically creates a Route53 domain using the specified druidDomain in the supplied hosted zone. Additionally, this solution creates a certificate in the AWS Certificate Manager (ACM) and associates it with the Application Load Balancer (ALB) to enable secure HTTPS communication. +With the following Route 53 configuration, this guidance automatically creates a Route53 domain using the specified druidDomain in the supplied hosted zone. Additionally, this guidance creates a certificate in the AWS Certificate Manager (ACM) and associates it with the Application Load Balancer (ALB) to enable secure HTTPS communication. @@ -142 +142 @@ With the following Route 53 configuration, this solution automatically creates a -If none of these configurations are set up, the solution assigns a generic Application Load Balancer (ALB) domain name for your Druid cluster which will expose HTTP protocol only. You have the flexibility to set up the domain outside of the solution. In such a case, you must configure the TLS certificate and the `druidDomain` to facilitate secure HTTPS access to the Druid cluster after the domain has been successfully set up. +If none of these configurations are set up, the guidance assigns a generic Application Load Balancer (ALB) domain name for your Druid cluster which will expose HTTP protocol only. You have the flexibility to set up the domain outside of the guidance. In such a case, you must configure the TLS certificate and the `druidDomain` to facilitate secure HTTPS access to the Druid cluster after the domain has been successfully set up. @@ -167 +167 @@ If you want to use FIPS 140-2 validated cryptographic modules, you can set this -By default, this solution activates basic authentication, enabling access to the Druid web console and API through a username and password. Additionally, you can use user access federation through a third-party identity provider (IdP) that supports OpenID Connect (OIDC) authentication. If you have an existing enterprise Identity Provider, you can integrate it using this CDK configuration. +By default, this guidance activates basic authentication, enabling access to the Druid web console and API through a username and password. Additionally, you can use user access federation through a third-party identity provider (IdP) that supports OpenID Connect (OIDC) authentication. If you have an existing enterprise Identity Provider, you can integrate it using this CDK configuration. @@ -236 +236 @@ The intended computing service for hosting a Druid cluster currently has two opt - * EC2: The solution will be deployed on Amazon EC2 hosts. For more information on how to configure Druid EC2, refer to the Druid EC2 configuration section. + * EC2: The guidance will be deployed on Amazon EC2 hosts. For more information on how to configure Druid EC2, refer to the Druid EC2 configuration section. @@ -244 +244 @@ The intended computing service for hosting a Druid cluster currently has two opt - * EKS: The solution will be deployed on Amazon EKS. + * EKS: The guidance will be deployed on Amazon EKS. @@ -251 +251 @@ The intended computing service for hosting a Druid cluster currently has two opt -By default, this solution creates an IAM role that gives Druid components the minimum permissions to function. You can extend this role with additional permissions by using the following configuration: +By default, this guidance creates an IAM role that gives Druid components the minimum permissions to function. You can extend this role with additional permissions by using the following configuration: @@ -280 +280 @@ It is the customer’s responsibility to ensure the extension’s security, perf -To load any custom extensions that you have developed in-house, make sure that the artifacts for those extensions (such as Java JAR files) are also copied into the `source/lib/docker/extensions` folder. To reduce the configuration overhead, the solution will automatically incorporate the extensions to the user provided extension list: +To load any custom extensions that you have developed in-house, make sure that the artifacts for those extensions (such as Java JAR files) are also copied into the `source/lib/docker/extensions` folder. To reduce the configuration overhead, the guidance will automatically incorporate the extensions to the user provided extension list: @@ -312 +312 @@ To load any custom extensions that you have developed in-house, make sure that t -By default, the solution features a common.runtime.properties file located within the `source/lib/uploads/config/_common` directory, to cater to the majority of the use cases. However, you can customize and override the settings in this file using the CDK configuration as needed. +By default, the guidance features a common.runtime.properties file located within the `source/lib/uploads/config/_common` directory, to cater to the majority of the use cases. However, you can customize and override the settings in this file using the CDK configuration as needed. @@ -351 +351 @@ Alternatively, you can use the Druid API or the Druid Web Console to configure t -In the default configuration, this solution sets up an Amazon Aurora Serverless v1 cluster, using the PostgreSQL-compatible engine as the metadata store for Druid. If you prefer to use an Amazon Aurora cluster as the metadata store, connect to an existing PostgreSQL database, or create the metadata store from a snapshot, you can customize the configuration by applying the following settings: +In the default configuration, this guidance sets up an Amazon Aurora Serverless v1 cluster, using the PostgreSQL-compatible engine as the metadata store for Druid. If you prefer to use an Amazon Aurora cluster as the metadata store, connect to an existing PostgreSQL database, or create the metadata store from a snapshot, you can customize the configuration by applying the following settings: @@ -412 +412 @@ This section provides instructions on how to create a new Aurora metadata store -The solution will try to create two magic users, specifically `admin` and `druid_system`, to run internal operations if these users don’t exist in the snapshot. If these users already exist in the snapshot, generate a secret in AWS Secrets Manager that includes both the username and password, and then proceed to integrate it into the metadata store configuration. If the secrets are encrypted by a KMS key, ensure that the KMS key permits access from AWS Secrets Manager to enable decryption of the secret. +The guidance will try to create two magic users, specifically `admin` and `druid_system`, to run internal operations if these users don’t exist in the snapshot. If these users already exist in the snapshot, generate a secret in AWS Secrets Manager that includes both the username and password, and then proceed to integrate it into the metadata store configuration. If the secrets are encrypted by a KMS key, ensure that the KMS key permits access from AWS Secrets Manager to enable decryption of the secret. @@ -467 +467 @@ This section explains how to use your own PostgreSQL database for the metadata s -By default, this solution will enforce TLS for the database connectivity. If you’re using non-public certificates, you must ensure the non-public certificates can be validated by the Druid system. +By default, this guidance will enforce TLS for the database connectivity. If you’re using non-public certificates, you must ensure the non-public certificates can be validated by the Druid system. @@ -503 +503 @@ Example configuration to connect to an external metadata store: -By default, this solution will set up a bucket in Amazon S3 for deep storage. To use your own bucket for deep storage, you can override this default configuration using the following configuration: +By default, this guidance will set up a bucket in Amazon S3 for deep storage. To use your own bucket for deep storage, you can override this default configuration using the following configuration: @@ -530 +530 @@ This section provides instructions and details about the Auto scaling group conf -This solution also fully supports the [service tiering](https://druid.apache.org/docs/latest/operations/mixed-workloads/) functionalities provided by Druid, offering enhanced resource management and optimization. The service tiering feature allows you to create distinct groups of Historicals and Brokers, each responsible for managing queries based on the segments and resource requirements of the query. +This guidance also fully supports the [service tiering](https://druid.apache.org/docs/latest/operations/mixed-workloads/) functionalities provided by Druid, offering enhanced resource management and optimization. The service tiering feature allows you to create distinct groups of Historicals and Brokers, each responsible for managing queries based on the segments and resource requirements of the query. @@ -561 +561 @@ It minimizes the impact on application availability and ensures a smooth transit -The solution operates on a default process of sequentially replacing the Druid EC2 instances in a specific order: data, query, and master. This replacement process involves stopping the previous instance initially, followed by the creation of a new instance. +The guidance operates on a default process of sequentially replacing the Druid EC2 instances in a specific order: data, query, and master. This replacement process involves stopping the previous instance initially, followed by the creation of a new instance. @@ -594 +594 @@ An Auto scaling policy consists of predefined rules and parameters that dictate -The solution comes pre-configured with Druid, which suits most use cases. You can customize the Druid configuration (runtime.properties) using the following settings: +The guidance comes pre-configured with Druid, which suits most use cases. You can customize the Druid configuration (runtime.properties) using the following settings: @@ -720 +720 @@ You can find more configuration examples about EC2 configuration in the `source/ -The solution will set up a new Amazon EKS cluster to serve as the hosting environment for Druid. +The guidance will set up a new Amazon EKS cluster to serve as the hosting environment for Druid. @@ -992 +992 @@ Deployment process overview -Monitor the solution +Monitor the guidance