AWS evs documentation change
Summary
Updated prerequisites and procedures to emphasize explicit route table configuration, added new sections for transit gateway/Direct Connect configuration, and clarified network connectivity requirements
Security assessment
Changes focus on proper network configuration practices rather than addressing specific vulnerabilities. Added documentation about mandatory route table associations and network ACLs helps users implement secure network segmentation, but there's no evidence of patching a specific security flaw.
Diff
diff --git a/evs/latest/userguide/getting-started.md b/evs/latest/userguide/getting-started.md index e8c946208..ca20b592c 100644 --- a//evs/latest/userguide/getting-started.md +++ b//evs/latest/userguide/getting-started.md @@ -5 +5 @@ -PrerequisitesCreate a VPC with subnets and route tablesConfigure DNS and NTP servers using the VPC DHCP option set(Optional) Configure on-premises network connectivity using AWS Direct Connect or AWS Site-to-Site VPN with AWS Transit GatewaySet up a VPC Route Server instance with endpoints and peersCreate an Amazon EVS environmentVerify Amazon EVS environment creationAssociate Amazon EVS VLAN subnets to a route tableCreate a network ACL to control Amazon EVS VLAN subnet trafficRetrieve VCF credentials and access VCF management appliancesConfigure the EC2 Serial ConsoleClean upNext steps +PrerequisitesCreate a VPC with subnets and route tablesConfigure the VPC main route tableConfigure DNS and NTP servers using the VPC DHCP option set(Optional) Configure on-premises network connectivitySet up a VPC Route Server instance with endpoints and peersCreate an Amazon EVS environmentVerify Amazon EVS environment creationExplicitly associate Amazon EVS VLAN subnets to a VPC route table(Optional) Configure transit gateway route tables and Direct Connect prefixes for on-premises connectivityCreate a network ACL to control Amazon EVS VLAN subnet trafficRetrieve VCF credentials and access VCF management appliancesConfigure the EC2 Serial ConsoleClean upNext steps @@ -30,0 +31,2 @@ Amazon EVS only supports VCF version 5.2.1.x at this time. + * Configure the VPC main route table + @@ -33 +35 @@ Amazon EVS only supports VCF version 5.2.1.x at this time. - * (Optional) Configure on-premises network connectivity using AWS Direct Connect or AWS Site-to-Site VPN with AWS Transit Gateway + * (Optional) Configure on-premises network connectivity @@ -41 +43,3 @@ Amazon EVS only supports VCF version 5.2.1.x at this time. - * Associate Amazon EVS VLAN subnets to a route table + * Explicitly associate Amazon EVS VLAN subnets to a VPC route table + + * (Optional) Configure transit gateway route tables and Direct Connect prefixes for on-premises connectivity @@ -124 +128,4 @@ Amazon EVS does not support gateway VPC endpoints for Amazon S3 at this time. To -Amazon VPC automatically creates a main route table and associates subnets to it by default. Amazon EVS will create subnets in the main route table. +During VPC creation, Amazon VPC automatically creates a main route table and implicitly associates subnets to it by default. + + + @@ -125,0 +133 @@ Amazon VPC automatically creates a main route table and associates subnets to it +## Configure the VPC main route table @@ -126,0 +135 @@ Amazon VPC automatically creates a main route table and associates subnets to it +Amazon EVS subnets are implicitly associated to your VPC’s main route table when they are created. To enable connectivity to dependent services such as DNS or on-premises systems for successful environment deployment, you must configure the main route table to allow traffic to these systems. For more information about managing subnet route tables, see [Manage subnet route tables](https://docs.aws.amazon.com/vpc/latest/userguide/WorkWithRouteTables.html#Route_Replacing_Main_Table) in the _Amazon VPC User Guide_. @@ -127,0 +137,5 @@ Amazon VPC automatically creates a main route table and associates subnets to it +After the Amazon EVS environment deploys, you can configure explicit route table associations to enable connectivity through a custom route table. For more information, see [Replace the main route table](https://docs.aws.amazon.com/vpc/latest/userguide/Route_Replacing_Main_Table.html) in the _Amazon VPC User Guide_. + +###### Important + +Amazon EVS supports the use of a custom route table only after the Amazon EVS environment is created. Custom route tables should not be used during Amazon EVS environment creation, as this may result in connectivity issues. @@ -135 +149 @@ Amazon EVS uses your VPC’s DHCP option set to retrieve the following: - * Network Time Protocol (NTP) servers that are used to avoid time sychronization issues in the SDDC. + * Network Time Protocol (NTP) servers that are used to avoid time synchronization issues in the SDDC. @@ -141,0 +156,2 @@ You can create a DHCP option set using the Amazon VPC console or AWS CLI. For mo +To enable DNS connectivity for successful environment deployment, you must first configure the VPC’s main route table to allow DNS traffic. For more information, see Configure the VPC main route table. + @@ -183 +199 @@ For more information about NTP servers, see [RFC 2123](https://datatracker.ietf. -## (Optional) Configure on-premises network connectivity using AWS Direct Connect or AWS Site-to-Site VPN with AWS Transit Gateway +## (Optional) Configure on-premises network connectivity @@ -187 +203 @@ You can configure connectivity for your on-premises data center to your AWS infr -###### Note +To enable connectivity to on-premises systems for successful environment deployment, you must configure the VPC’s main route table to allow traffic to these systems. For more information, see Configure the VPC main route table. @@ -189 +205 @@ You can configure connectivity for your on-premises data center to your AWS infr -Amazon EVS does not support connectivity via an AWS Direct Connect private virtual interface (VIF), or via an AWS Site-to-Site VPN connection that terminates directly into the underlay VPC. +After the Amazon EVS environment is created, you must update the transit gateway route tables with the VPC CIDRs created within the Amazon EVS environment. For more information, see (Optional) Configure transit gateway route tables and Direct Connect prefixes for on-premises connectivity. @@ -192,0 +209,4 @@ For more information about setting up an AWS Direct Connect connection, see [AWS +###### Note + +Amazon EVS does not support connectivity via an AWS Direct Connect private virtual interface (VIF), or via an AWS Site-to-Site VPN connection that terminates directly into the underlay VPC. + @@ -222,0 +243,4 @@ To get started as simply and quickly as possible, this topic includes steps to c +You environment ID will be available to Amazon EVS across all AWS Regions for VCF license compliance needs. + +###### Note + @@ -261,0 +286,4 @@ The VCF solution key must have at least 256 cores. +Your VCF license will be available to Amazon EVS across all AWS Regions for license compliance. Amazon EVS does not validate license keys. To validate license keys, visit [Broadcom support](https://support.broadcom.com/web/ecx). + +###### Note + @@ -271,0 +300,4 @@ The vSAN license key must have at least 110 TiB of vSAN capacity. +Your VCF license will be available to Amazon EVS across all AWS Regions for license compliance. Amazon EVS does not validate license keys. To validate license keys, visit [Broadcom support](https://support.broadcom.com/web/ecx). + +###### Note + @@ -353,0 +386,4 @@ Tags that are associated with the Amazon EVS environment do not propagate to und +###### Important + +During environment deployment, Amazon EVS creates the EVS VLAN subnets and implicitly associates them with the main route table. After the deployment completes, you must explicitly associate the Amazon EVS VLAN subnets with a route table for NSX connectivity purposes. For more information, see Explicitly associate Amazon EVS VLAN subnets to a VPC route table. + @@ -375,0 +412,4 @@ Before running the `aws evs create-environment` command, check that all Amazon E +###### Important + +During environment deployment, Amazon EVS creates the EVS VLAN subnets and implicitly associates them with the main route table. After the deployment completes, you must explicitly associate the Amazon EVS VLAN subnets with a route table for NSX connectivity purposes. For more information, see Explicitly associate Amazon EVS VLAN subnets to a VPC route table. + @@ -382 +422 @@ Amazon EVS deploys a recent bundled version of VMware Cloud Foundation which may -Environment creation can take several hours. +Environment deployment can take several hours. @@ -641 +681 @@ The following is a sample response. -## Associate Amazon EVS VLAN subnets to a route table +## Explicitly associate Amazon EVS VLAN subnets to a VPC route table @@ -643 +683 @@ The following is a sample response. -Associate each of the Amazon EVS VLAN subnets with a route table in your VPC. This route table is used to allow AWS resources to communicate with virtual machines on NSX network segments, running with Amazon EVS. +Explicitly associate each of the Amazon EVS VLAN subnets with a route table in your VPC. This route table is used to allow AWS resources to communicate with virtual machines on NSX network segments, running with Amazon EVS. @@ -682,0 +723,6 @@ AWS CLI +## (Optional) Configure transit gateway route tables and Direct Connect prefixes for on-premises connectivity + +If you are configuring on-premises network connectivity using AWS Direct Connect or AWS Site-to-Site VPN with a transit gateway, you must update the transit gateway route tables with the VPC CIDRs created within the Amazon EVS environment. For more information, see [Transit gateway route tables in Amazon VPC Transit Gateways](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-route-tables.html). + +If you are using AWS Direct Connect, you may need to also update your Direct Connect prefixes to send and receive updated routes from the VPC. For more information, see [Allows prefixes interactions for AWS Direct Connect gateways](https://docs.aws.amazon.com/directconnect/latest/UserGuide/allowed-to-prefixes.html). +