AWS vm-import high security documentation change
Summary
Restructured prerequisites for VM export, added detailed S3 bucket configuration steps including ownership settings, ACL requirements, and region-specific canonical account IDs. Provided explicit CLI/console/PowerShell examples for bucket policies and permissions.
Security assessment
The changes explicitly warn against using 'bucket owner enforced' S3 Object Ownership (which disables ACLs) and provide secure configuration examples. This addresses potential misconfigurations that could lead to unauthorized access or data exposure. The addition of granular permissions (READ_ACP, WRITE) and region-specific principal IDs helps enforce least-privilege access for VM exports.
Diff
diff --git a/vm-import/latest/userguide/vmexport-prerequisites.md b/vm-import/latest/userguide/vmexport-prerequisites.md index 142c8b2e5..6a04f7942 100644 --- a//vm-import/latest/userguide/vmexport-prerequisites.md +++ b//vm-import/latest/userguide/vmexport-prerequisites.md @@ -5,3 +5 @@ -# Prerequisites for exporting an instance from Amazon EC2 - -To export a VM from Amazon EC2, first meet the following prerequisites. +Configure your S3 bucket @@ -9,3 +7 @@ To export a VM from Amazon EC2, first meet the following prerequisites. - * Install the AWS CLI. For more information, see the [AWS Command Line Interface User Guide](https://docs.aws.amazon.com/cli/latest/userguide/). - -###### Tip +# Prerequisites for exporting an instance from Amazon EC2 @@ -13 +9 @@ To export a VM from Amazon EC2, first meet the following prerequisites. -In [supported AWS Regions](https://docs.aws.amazon.com/cloudshell/latest/userguide/supported-aws-regions.html), you can also use [AWS CloudShell](https://docs.aws.amazon.com/cloudshell/latest/userguide/welcome.html) for a browser-based, pre-authenticated shell that launches directly from the AWS Management Console. +To export a VM from Amazon EC2, first meet the following prerequisites: @@ -17,14 +13 @@ In [supported AWS Regions](https://docs.aws.amazon.com/cloudshell/latest/usergui - * Prepare your S3 bucket by attaching an access control list (ACL) containing the following grants. For more information, see [Managing access with ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acls.html) in the _Amazon Simple Storage Service User Guide_. - -###### Important - -You can't export a VM to an S3 bucket that uses the bucket owner enforced setting for S3 Object Ownership because ACLs are disabled. For more information, see [Configuring ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/managing-acls.html) in the _Amazon Simple Storage Service User Guide_. - - * For `Grantee`, provide the appropriate Region-specific canonical account ID: - -**Africa (Cape Town)** - - -3f7744aeebaf91dd60ab135eb1cf908700c8d2bc9133e61261e6c582be6e33ee - -**Asia Pacific (Hong Kong)** + * You can't export a VM to an S3 bucket that uses the bucket owner enforced setting for S3 Object Ownership because ACLs are disabled. For more information, see [Configuring ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/managing-acls.html) in the _Amazon Simple Storage Service User Guide_. @@ -31,0 +15 @@ You can't export a VM to an S3 bucket that uses the bucket owner enforced settin + * Prepare your S3 bucket by attaching an access control list (ACL) containing the following grants. For more information, see [Managing access with ACLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acls.html) in the _Amazon Simple Storage Service User Guide_. @@ -33,9 +17 @@ You can't export a VM to an S3 bucket that uses the bucket owner enforced settin -97ee7ab57cc9b5034f31e107741a968e595c0d7a19ec23330eae8d045a46edfb - -**Asia Pacific (Hyderabad)** - - -77ab5ec9eac9ade710b7defed37fe0640f93c5eb76ea65a64da49930965f18ca - -**Asia Pacific (Jakarta)** - + * For each `Grantee`, provide the following permissions: @@ -43 +19 @@ You can't export a VM to an S3 bucket that uses the bucket owner enforced settin -de34aaa6b2875fa3d5086459cb4e03147cf1a9f7d03d82f02bedb991ff3d1df5 + * `READ_ACP` (In the Amazon S3 console, **Bucket ACL** should have the **Read** permission) @@ -45 +21 @@ de34aaa6b2875fa3d5086459cb4e03147cf1a9f7d03d82f02bedb991ff3d1df5 -**Asia Pacific (Malaysia)** + * `WRITE` (In the Amazon S3 console, **Objects** should have the **Write** permission) @@ -46,0 +23 @@ de34aaa6b2875fa3d5086459cb4e03147cf1a9f7d03d82f02bedb991ff3d1df5 + * For `Grantee`, provide the appropriate Region-specific canonical account ID: @@ -48 +25 @@ de34aaa6b2875fa3d5086459cb4e03147cf1a9f7d03d82f02bedb991ff3d1df5 -ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 + * Africa (Cape Town) – 3f7744aeebaf91dd60ab135eb1cf908700c8d2bc9133e61261e6c582be6e33ee @@ -50 +27 @@ ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 -**Asia Pacific (Melbourne)** + * Asia Pacific (Hong Kong) – 97ee7ab57cc9b5034f31e107741a968e595c0d7a19ec23330eae8d045a46edfb @@ -51,0 +29 @@ ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 + * Asia Pacific (Hyderabad) – 77ab5ec9eac9ade710b7defed37fe0640f93c5eb76ea65a64da49930965f18ca @@ -53 +31 @@ ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 -8b8ea36ab97c280aa8558c57a380353ac7712f01f82c21598afbb17e188b9ad5 + * Asia Pacific (Jakarta) – de34aaa6b2875fa3d5086459cb4e03147cf1a9f7d03d82f02bedb991ff3d1df5 @@ -55 +33 @@ ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 -**Asia Pacific (Osaka)** + * Asia Pacific (Malaysia) – ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 @@ -56,0 +35 @@ ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 + * Asia Pacific (Melbourne) – 8b8ea36ab97c280aa8558c57a380353ac7712f01f82c21598afbb17e188b9ad5 @@ -58 +37 @@ ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 -40f22ffd22d6db3b71544ed6cd00c8952d8b0a63a87d58d5b074ec60397db8c9 + * Asia Pacific (Osaka) – 40f22ffd22d6db3b71544ed6cd00c8952d8b0a63a87d58d5b074ec60397db8c9 @@ -60 +39 @@ ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 -**Asia Pacific (Taipei)** + * Asia Pacific (Taipei) – a9fa0eb7c8483f9558cd14b24d16e9c4d1555261a320b586a3a06908ff0047ce @@ -61,0 +41 @@ ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 + * Asia Pacific (Thailand) – d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd @@ -63 +43 @@ ed006f67543afcfe0779e356e52d5ed53fa45f95bcd7d277147dfc027aaca0e7 -a9fa0eb7c8483f9558cd14b24d16e9c4d1555261a320b586a3a06908ff0047ce + * Canada West (Calgary) – 78e12f8d798f89502177975c4ccdac686c583765cea2bf06e9b34224e2953c83 @@ -65 +45 @@ a9fa0eb7c8483f9558cd14b24d16e9c4d1555261a320b586a3a06908ff0047ce -**Asia Pacific (Thailand)** + * Europe (Milan) – 04636d9a349e458b0c1cbf1421858b9788b4ec28b066148d4907bb15c52b5b9c @@ -66,0 +47 @@ a9fa0eb7c8483f9558cd14b24d16e9c4d1555261a320b586a3a06908ff0047ce + * Europe (Spain) – 6e81c4c52a37a7f59e103625162ed97bcd0e646593adb107d21310d093151518 @@ -68 +49 @@ a9fa0eb7c8483f9558cd14b24d16e9c4d1555261a320b586a3a06908ff0047ce -d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd + * Europe (Zurich) – 5d9fcea77b2fb3df05fc15c893f212ae1d02adb4b24c13e18586db728a48da67 @@ -70 +51 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -**Canada West (Calgary)** + * Israel (Tel Aviv) – 328a78de7561501444823ebeb59152eca7cb58fee2fe2e4223c2cdd9f93ae931 @@ -71,0 +53 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd + * Mexico (Central) – edaff67fe25d544b855bd0ba9a74a99a2584ab89ceda0a9661bdbeca530d0fca @@ -73 +55 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -78e12f8d798f89502177975c4ccdac686c583765cea2bf06e9b34224e2953c83 + * Middle East (Bahrain) – aa763f2cf70006650562c62a09433f04353db3cba6ba6aeb3550fdc8065d3d9f @@ -75 +57 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -**Europe (Milan)** + * Middle East (UAE) – 7d3018832562b7b6c126f5832211fae90bd3eee3ed3afde192d990690267e475 @@ -76,0 +59 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd + * AWS GovCloud (US) – af913ca13efe7a94b88392711f6cfc8aa07c9d1454d4f190a624b126733a5602 @@ -78 +61 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -04636d9a349e458b0c1cbf1421858b9788b4ec28b066148d4907bb15c52b5b9c + * All other Regions – c4d8eabf8db69dbe46bfe0e517100c554f01200b104d59cd408e777ba442a322 @@ -80 +62,0 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -**Europe (Spain)** @@ -83 +64,0 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -6e81c4c52a37a7f59e103625162ed97bcd0e646593adb107d21310d093151518 @@ -85 +66 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -**Europe (Zurich)** +## Configure your S3 bucket @@ -86,0 +68 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd +Console @@ -88 +69,0 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -5d9fcea77b2fb3df05fc15c893f212ae1d02adb4b24c13e18586db728a48da67 @@ -90 +71 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -**Israel (Tel Aviv)** +###### To configure the S3 bucket @@ -91,0 +73 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd + 1. Open the Amazon S3 console at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/). @@ -93 +75 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -328a78de7561501444823ebeb59152eca7cb58fee2fe2e4223c2cdd9f93ae931 + 2. Select the bucket in which to store the exported instances. @@ -95 +77 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -**Mexico (Central)** + 3. On the **Permissions** tab, change the object ownership to **Bucket owner preferred**. @@ -96,0 +79 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd + 4. Attach the following bucket policy. For `CanonicalUser`, enter the canonical account ID for the bucket Region. For `Resource`, enter the name of your bucket in the bucket ARNs. @@ -98 +81,20 @@ d011fe83abcc227a7ac0f914ce411d3630c4ef735e92e88ce0aa796dcfecfbdd -edaff67fe25d544b855bd0ba9a74a99a2584ab89ceda0a9661bdbeca530d0fca + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "GrantReadAclAndWrite", + "Effect": "Allow", + "Principal": { + "CanonicalUser": "c4d8eabf8db69dbe46bfe0e517100c554f01200b104d59cd408e777ba442a322" + }, + "Action": [ + "s3:GetBucketAcl", + "s3:PutObject" + ], + "Resource": [ + "arn:aws:s3:::amzn-s3-demo-export-bucket", + "arn:aws:s3:::amzn-s3-demo-export-bucket/*" + ] + } + ] + } @@ -100 +101,0 @@ edaff67fe25d544b855bd0ba9a74a99a2584ab89ceda0a9661bdbeca530d0fca -**Middle East (Bahrain)** @@ -103 +103,0 @@ edaff67fe25d544b855bd0ba9a74a99a2584ab89ceda0a9661bdbeca530d0fca -aa763f2cf70006650562c62a09433f04353db3cba6ba6aeb3550fdc8065d3d9f @@ -105 +105 @@ aa763f2cf70006650562c62a09433f04353db3cba6ba6aeb3550fdc8065d3d9f -**Middle East (UAE)** +AWS CLI @@ -108 +108 @@ aa763f2cf70006650562c62a09433f04353db3cba6ba6aeb3550fdc8065d3d9f -7d3018832562b7b6c126f5832211fae90bd3eee3ed3afde192d990690267e475 +###### To configure the S3 bucket @@ -110 +110 @@ aa763f2cf70006650562c62a09433f04353db3cba6ba6aeb3550fdc8065d3d9f -**China (Beijing) and China (Ningxia)** +Use the [put-bucket-ownership-controls](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/put-bucket-ownership-controls.html) command to change the object ownership. @@ -113 +113,3 @@ aa763f2cf70006650562c62a09433f04353db3cba6ba6aeb3550fdc8065d3d9f -834bafd86b15b6ca71074df0fd1f93d234b9d5e848a2cb31f880c149003ce36f + aws s3api put-bucket-ownership-controls \ + --bucket amzn-s3-demo-export-bucket \ + --ownership-controls='{"Rules":[{"ObjectOwnership":"BucketOwnerPreferred"}]}' @@ -115 +117 @@ aa763f2cf70006650562c62a09433f04353db3cba6ba6aeb3550fdc8065d3d9f -**AWS GovCloud (US)** +Use the [put-bucket-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/put-bucket-policy.html) command to attach the bucket policy. For `CanonicalUser`, enter the canonical account ID for the bucket Region. For `Resource`, enter the name of your bucket in the bucket ARNs. @@ -118 +120,23 @@ aa763f2cf70006650562c62a09433f04353db3cba6ba6aeb3550fdc8065d3d9f -af913ca13efe7a94b88392711f6cfc8aa07c9d1454d4f190a624b126733a5602 + aws s3api put-bucket-policy \ + --bucket amzn-s3-demo-export-bucket \ + --policy \ + '{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "GrantReadAcpAndWrite", + "Effect": "Allow", + "Principal": { + "CanonicalUser": "c4d8eabf8db69dbe46bfe0e517100c554f01200b104d59cd408e777ba442a322" + }, + "Action": [ + "s3:GetBucketAcl", + "s3:PutObject" + ], + "Resource": [ + "arn:aws:s3:::amzn-s3-demo-export-bucket", + "arn:aws:s3:::amzn-s3-demo-export-bucket/*" + ] + } + ] + }' @@ -120 +144 @@ af913ca13efe7a94b88392711f6cfc8aa07c9d1454d4f190a624b126733a5602 -**All other Regions** +PowerShell