AWS dms high security documentation change
Summary
Expanded replication instance/serverless setup instructions with emphasis on private subnets, security groups, and disabling public access.
Security assessment
Detailed network isolation instructions (private subnets, no public IP) directly prevent accidental exposure of replication instances to public networks, a critical security control.
Diff
diff --git a/dms/latest/userguide/CHAP_VPC_Endpoints.md b/dms/latest/userguide/CHAP_VPC_Endpoints.md index 7d725cc23..7604b017a 100644 --- a//dms/latest/userguide/CHAP_VPC_Endpoints.md +++ b//dms/latest/userguide/CHAP_VPC_Endpoints.md @@ -5 +5 @@ -Who is impacted when migrating to AWS DMS versions 3.4.7 and higher?Who is not impacted when migrating to AWS DMS versions 3.4.7 and higher?Preparing a migration to AWS DMS versions 3.4.7 and higher +Common AWS DMS prerequisitesSet up an Amazon VPC endpoint with AWS Secrets ManagerSet up an Amazon VPC endpoint with Amazon S3Setup an Amazon VPC endpoint for Amazon DynamoDBSetup an Amazon VPC endpoint for Amazon KinesisSetup an Amazon VPC endpoint for Amazon RedshiftSetup an Amazon VPC endpoint for Amazon OpenSearch ServiceDMS replication instance (provisioned and Serverless), subnet groups, and endpointsWho is impacted when migrating to AWS DMS versions 3.4.7 and higher?Who is not impacted when migrating to AWS DMS versions 3.4.7 and higher?Preparing a migration to AWS DMS versions 3.4.7 and higher @@ -7 +7 @@ Who is impacted when migrating to AWS DMS versions 3.4.7 and higher?Who is not i -# Configuring VPC endpoints as AWS DMS source and target endpoints +# Configuring VPC endpoints for AWS DMS @@ -11 +11 @@ AWS DMS supports Amazon virtual private cloud (VPC) endpoints as sources and tar -By supporting Amazon VPC endpoints, AWS DMS makes it easier to maintain end-to-end network security for all replication tasks without additional networking configuration and setup. Using VPC endpoints for all source and target endpoints ensures that all your traffic remains within your VPC and under your control. Upgrades to AWS DMS versions 3.4.7 and higher require that you configure AWS DMS to use VPC endpoints or to use public routes to all your source and target endpoints that interact with the Amazon Web Services following: +By supporting Amazon VPC endpoints, AWS DMS makes it easier to maintain end-to-end network security for all replication tasks without additional networking configuration and setup. Using VPC endpoints for all source and target endpoints ensures that all your traffic remains within your VPC and under your control. @@ -13,3 +13 @@ By supporting Amazon VPC endpoints, AWS DMS makes it easier to maintain end-to-e - * Amazon S3 - - * Amazon Kinesis +For AWS DMS replication instance created in private subnet or AWS DMS serverless replication, to connect to AWS managed databases, it is necessary to set up an Amazon VPC endpoint: @@ -17 +15 @@ By supporting Amazon VPC endpoints, AWS DMS makes it easier to maintain end-to-e - * AWS Secrets Manager + * Amazon S3 @@ -20,0 +19,2 @@ By supporting Amazon VPC endpoints, AWS DMS makes it easier to maintain end-to-e + * Amazon Kinesis + @@ -25 +24,0 @@ By supporting Amazon VPC endpoints, AWS DMS makes it easier to maintain end-to-e - * Amazon Athena @@ -28,0 +28 @@ By supporting Amazon VPC endpoints, AWS DMS makes it easier to maintain end-to-e +If you are using AWS Secrets Manager to store connection credentials for DMS to use, you also need to set up a VPC endpoint. @@ -30 +30 @@ By supporting Amazon VPC endpoints, AWS DMS makes it easier to maintain end-to-e -You might need VPC endpoints to support AWS DMS starting with version 3.4.7 as described following. +Starting with AWS DMS version 3.4.7, VPC endpoints are required to establish connection between DMS replication instance or Serverless replication and the above Amazon services, when private network is used. @@ -32 +32 @@ You might need VPC endpoints to support AWS DMS starting with version 3.4.7 as d -## Who is impacted when migrating to AWS DMS versions 3.4.7 and higher? +## Common AWS DMS prerequisites @@ -34 +34 @@ You might need VPC endpoints to support AWS DMS starting with version 3.4.7 as d -You are impacted if you are using one or more of the previously listed AWS DMS endpoints, and these endpoints are not publicly routable or they don’t have VPC endpoints already associated with them. +Before you configure a VPC endpoint, you must meet the following prerequisites: @@ -36 +36 @@ You are impacted if you are using one or more of the previously listed AWS DMS e -## Who is not impacted when migrating to AWS DMS versions 3.4.7 and higher? + * Locate or create the VPC to use with AWS DMS replication instance or AWS DMS serverless replication. If you do not provide this information, DMS attempts to use the default VPC in the region, where it is setup. @@ -38 +38 @@ You are impacted if you are using one or more of the previously listed AWS DMS e -You are not impacted if: + * Ensure you have IAM permissions to create VPC endpoint. To connect to Amazon S3 and Amazon DynamoDB, you can create Gateway VPC endpoints that provide reliable connectivity without requiring an internet gateway or a NAT device for your VPC. Gateway endpoints do not use AWS PrivateLink, unlike other types of VPC endpoints. For more information, see [Gateway endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html) in the _AWS PrivateLink guide_. @@ -40 +40 @@ You are not impacted if: - * You aren't using one or more of the previously listed AWS DMS endpoints. + * Configure IAM permissions to use DMS: @@ -42 +42 @@ You are not impacted if: - * You are using any of the previously listed endpoints and they are publically routable. + * Configure the `dms-vpc-role` role. For more information, see [AWS managed policy: AmazonDMSVPCManagementRole](https://docs.aws.amazon.com/dms/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonDMSVPCManagementRole). @@ -44 +44 @@ You are not impacted if: - * You are using any of the previously listed endpoints and they have VPC endpoints associated with them. + * Configure the `dms-cloudwatch-logs-role` role. For more information, see [AWS managed policy: AmazonDMSCloudWatchLogsRole](https://docs.aws.amazon.com/dms/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonDMSCloudWatchLogsRole). @@ -45,0 +46 @@ You are not impacted if: + * AWS DMS Serverless requires a service linked role (SLR) to exist in your account. AWS DMS manages the creation and usage of this role. For more information about making sure that you have the necessary SLR, see [Service-linked role for AWS DMS Serverless](https://docs.aws.amazon.com/dms/latest/userguide/slr-services-sl.html). When you create a replication, AWS DMS Serverless programmatically creates a Serverless service linked role. You can view this role in the IAM console. @@ -49 +49,0 @@ You are not impacted if: -## Preparing a migration to AWS DMS versions 3.4.7 and higher @@ -51 +51 @@ You are not impacted if: -To prevent AWS DMS task failures when you are using any of the endpoints described previously, take one of the steps following prior to upgrading AWS DMS to version 3.4.7 or higher: +## Set up an Amazon VPC endpoint with AWS Secrets Manager @@ -53 +53 @@ To prevent AWS DMS task failures when you are using any of the endpoints describ - * Make the impacted AWS DMS endpoints publicly routable. For example, add an Internet Gateway (IGW) route to any VPC already used by your AWS DMS replication instance to make all its source and target endpoints publicly routable. +You can set up an Amazon VPC endpoint for AWS Secrets Manager to work with AWS DMS. By creating this endpoint, you enable AWS DMS replication instances or serverless replication configurations in private subnets to securely access database credentials stored in Secrets Manager without requiring public internet access. @@ -55 +55 @@ To prevent AWS DMS task failures when you are using any of the endpoints describ - * Create VPC endpoints to access all source and target endpoints used by AWS DMS as described following. +**Prerequisites** @@ -56,0 +57 @@ To prevent AWS DMS task failures when you are using any of the endpoints describ +Before you configure a VPC endpoint with AWS Secrets Manager in AWS DMS, you must meet the following prerequisites: @@ -57,0 +59 @@ To prevent AWS DMS task failures when you are using any of the endpoints describ + * Ensure you configure all the Common AWS DMS prerequisites. @@ -58,0 +61 @@ To prevent AWS DMS task failures when you are using any of the endpoints describ + * Create and configure [source](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Introduction.Sources.html) or [target](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Introduction.Targets.html) database that you want to connect with. @@ -60 +63,7 @@ To prevent AWS DMS task failures when you are using any of the endpoints describ -For any existing VPC endpoints that you use for your AWS DMS source and target endpoints, ensure that they use a trust policy that conforms with the XML policy document, `dms-vpc-role`. For more information on this XML policy document, see [Creating the IAM roles to use with AWS DMS](./security-iam.html#CHAP_Security.APIRole). + * Create secret in AWS Secrets manager with credentials to access source and target databases. Secret must be located in the same region as AWS DMS replication instance or AWS DMS serverless replication. Depending on the database type, the schema of the secret can vary. For more information, see [Working with AWS DMS endpoints](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Endpoints.html). + +###### Important + +AWS DMS replication instance and AWS DMS serverless replication do not work with secrets, managed by Amazon RDS. These credentials do not include host and port information, that is required by AWS DMS to establish connections. + + * Configuring IAM permissions to manage DMS endpoint is required for some databases: Amazon S3, Amazon Kinesis, Amazon DynamoDB, Amazon Redshift, Amazon OpenSearch Service, Amazon Neptune, and Amazon Timestream. For more information see [Working with AWS DMS endpoints](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Endpoints.html). @@ -62 +71,24 @@ For any existing VPC endpoints that you use for your AWS DMS source and target e -Otherwise, configure your replication instances as VPC endpoints by adding a VPC endpoint to the VPC containing them. If you configured your replication instances without public endpoints, adding a publically-accessible VPC endpoint to the VPC that contains your replication instances makes them publically accessible. You don't need to do anything further to specifically associate your replication instances with the VPC endpoint. + + + +###### Create VPC endpoint for AWS Secrets Manager + + 1. Sign in to the AWS Management Console and open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). + + 2. On the VPC console menu bar, choose the same AWS Region as your AWS DMS replication instance. + + 3. In the VPC navigation pane, choose **Endpoints**. + + 4. In **Endpoints** , choose **Create endpoint**. + + 5. Configure the VPC endpoint as follows: + + 1. Select **Type** as **AWS Services**. + + 2. In the **Service Name** textbox, search for `secretsmanager` and select **com.amazonaws.[region].secretsmanager**. Ensure that the **Type** for your selected service is **Interface**. + + 3. Under **Network settings** select the VPC that is running in the same region as your DMS replication instance or where you created Serverless replication. + + 4. In the **Subnets** section, select your desired subnets where you want DMS to operate. Ensure you only select private subnets. You can identify a private subnet with the subnet ID. For example: `vpc-xxxxxx-subnet-private1-us-west-2a`. + +If your DMS replication instance is created without public access, you must choose the route tables associated with the private subnets where your replication instance resides. @@ -66 +98,24 @@ Otherwise, configure your replication instances as VPC endpoints by adding a VPC -Different services might have unique VPC endpoint configurations. For instance, when using AWS Secrets Manager, you typically don't need to adjust the routing table. Always check the specific requirements for each service. +Ensure you note the private subnets as you are required to provide them when creating DMS replication subnet group. To connect DMS with the AWS Secrets manager using the VPC endpoints, the subnets specified for VPC endpoint must be the same as the subnets in DMS replication subnet group. + + 5. Select your desired **Security groups**. The security group rules control the traffic to the endpoint network interface from the resources in your VPC. If you do not specify a security group, the default security group is selected. + + 6. Select **Full access** under **Policy**. If you want to use custom policy to specify your own access control select **Custom**. You can use a trust policy that conforms with the JSON policy document, `dms-vpc-role`. For more information, see [Creating the IAM roles to use with AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/security-iam.html#CHAP_Security.APIRole). + + 7. Select **Create endpoint**. + +You must wait until the status becomes `Available`. Your VPC endpoint now has an ID starting with `vpce-xxxx`. + + + + +You have now successfully created a VPC endpoint. You must configure AWS DMS Endpoints, DMS subnet groups. Depending on migration option you choose, configure DMS replication instance or Serverless replication. + +## Set up an Amazon VPC endpoint with Amazon S3 + +You can set up an Amazon VPC endpoint for Amazon S3 to work with AWS DMS. By creating this endpoint, you enable AWS DMS replication instances or serverless replication configurations in private subnets to securely access database credentials stored in S3 buckets without requiring public internet access. + +**Prerequisites** + +Before you configure a VPC endpoint with Amazon S3 in AWS DMS, you must meet the following prerequisites: + + * Ensure you configure all the Common AWS DMS prerequisites. @@ -68 +123,8 @@ Different services might have unique VPC endpoint configurations. For instance, -###### Create a VPC endpoint on the VPC containing your replication instance + * Create an Amazon S3 bucket to use as [source](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Introduction.Sources.html) or [target](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Introduction.Targets.html) databases with AWS DMS. Do not enable versioning for S3. If you need S3 versioning, use lifecycle policies to actively delete old versions. Otherwise, you can encounter endpoint test connection failures because of an S3 list-object call timeout. + + * Configure IAM permissions to manage DMS Amazon S3 endpoint. If you are using AWS DMS Console, the IAM role with the necessary permissions can be created if you have permissions to create IAM roles. + + + + +###### Create a VPC endpoint for Amazon S3 @@ -78 +140,76 @@ Different services might have unique VPC endpoint configurations. For instance, - 5. You can optionally specify a name tag. For example, `my-endpoint-DynamoDB-01`. + 5. Configure the VPC endpoint as follows: + + 1. Select **Type** as **AWS Services**. + + 2. In the **Service Name** textbox, search for `s3` and select **com.amazonaws.[region].s3**. Ensure that the **Type** for your selected service is **Gateway**. You can create a Gateway VPC endpoint when connecting to Amazon S3 and DynamoDB. Gateway endpoints do not use AWS PrivateLink, unlike other types of VPC endpoints. + + 3. Under **Network settings** select the VPC that is running in the same region as your DMS replication instance or where you created Serverless replication. + + 4. In the **Subnets** section, select your desired subnets where you want DMS to operate. Ensure you only select private subnets. You can identify a private subnet with the subnet ID. For example: `vpc-xxxxxx-subnet-private1-us-west-2a`. + +###### Note + +If you have created your DMS replication instance without public access, you must choose the route tables associated with private subnets that are in the same region as your DMS instance. Ensure you note the private subnets as you are required to provide them when creating DMS replication subnet group. To connect DMS with Amazon S3 using the VPC endpoints, the subnets specified for VPC endpoint must be the same as the subnets in DMS replication subnet group. + + 6. Select **Full access** under **Policy**. If you want to use custom policy to specify your own access control select **Custom**. You can use a trust policy that conforms with the JSON policy document, `dms-vpc-role`. For more information, see [Creating the IAM roles to use with AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/security-iam.html#CHAP_Security.APIRole). + + 7. Select **Create endpoint**. + +You must wait until the status becomes `Available`. Your VPC endpoint now has an ID starting with `vpce-xxxx`. + + + + +You have now successfully created a VPC endpoint. You must configure AWS DMS Endpoints, DMS subnet groups. Depending on migration option you choose, configure DMS replication instance or Serverless replication. + +## Setup an Amazon VPC endpoint for Amazon DynamoDB + +When using AWS DMS replication instances in private subnets or AWS DMS serverless replication, you must create a VPC endpoint to establish secure connectivity with Amazon DynamoDB. Without a VPC endpoint configuration, AWS DMS faces connection errors. + +When creating the VPC endpoint, you must select **Endpoint type** as **Gateway** or **Interface** in the DMS Console. For more information, see: + + * Common AWS DMS prerequisites + + * [Gateway endpoints for Amazon DynamoDB](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html) + + * [How do I troubleshoot connectivity issues with my gateway Amazon VPC endpoints?](https://repost.aws/knowledge-center/connect-s3-vpc-endpoint) + + + + +## Setup an Amazon VPC endpoint for Amazon Kinesis + +When using AWS DMS replication instances in private subnets or AWS DMS serverless replication, you must create a VPC endpoint to establish secure connectivity with Amazon Kinesis. Without a VPC endpoint configuration, AWS DMS faces connection errors. For more information, see: + + * Common AWS DMS prerequisites + + * [Using Amazon Kinesis Data Streams as a target for AWS Database Migration Service](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Kinesis.html) + + + + +## Setup an Amazon VPC endpoint for Amazon Redshift + +When using AWS DMS replication instances in private subnets or AWS DMS serverless replication, you must create a VPC endpoint to establish secure connectivity with Amazon Redshift. Without a VPC endpoint configuration, AWS DMS faces connection errors. For more information, see: + + * Common AWS DMS prerequisites