AWS evs documentation change
Summary
Added documentation for creating VPC Route Server infrastructure and transit gateway for on-premises connectivity. Expanded DHCP/DNS configuration requirements and added NTP configuration guidance.
Security assessment
The changes include DNS/NTP configuration best practices (using Amazon's trusted NTP server) and network architecture guidance. While these relate to secure configuration, there is no evidence they address a specific security vulnerability. The NTP guidance promotes using a trusted time source, which is a security best practice.
Diff
diff --git a/evs/latest/userguide/setting-up.md b/evs/latest/userguide/setting-up.md index 4c8116795..991675045 100644 --- a//evs/latest/userguide/setting-up.md +++ b//evs/latest/userguide/setting-up.md @@ -5 +5 @@ -Sign up for AWSCreate an IAM userCreate an IAM role to delegate Amazon EVS permission to an IAM userSign up for an AWS Business, AWS Enterprise On-Ramp, or AWS Enterprise Support planCheck quotasPlan VPC CIDR sizes and configure VPC componentsCreate an Amazon EC2 Capacity ReservationSet up the AWS CLICreate an Amazon EC2 key pairPrepare your environment for VMware Cloud Foundation (VCF)Acquire VCF license keysVMware HCX prerequisites +Sign up for AWSCreate an IAM userCreate an IAM role to delegate Amazon EVS permission to an IAM userSign up for an AWS Business, AWS Enterprise On-Ramp, or AWS Enterprise Support planCheck quotasPlan VPC CIDR sizes and configure VPC componentsCreate VPC Route Server infrastructureCreate a transit gatway for on-premesis connectivityCreate an Amazon EC2 Capacity ReservationSet up the AWS CLICreate an Amazon EC2 key pairPrepare your environment for VMware Cloud Foundation (VCF)Acquire VCF license keysVMware HCX prerequisites @@ -28,0 +29,4 @@ To use Amazon EVS, you will need to configure other AWS services, as well as set + * Create VPC Route Server infrastructure + + * Create a transit gatway for on-premesis connectivity + @@ -221,0 +226,13 @@ Amazon EVS uses your VPC’s DHCP option set to retrieve the following: +To successfully deploy an Amazon EVS environment, your VPC’s DHCP option set must have the following DNS settings: + + * A primary DNS server IP address and a secondary DNS server IP address in the DHCP option set. + + * A DNS forward lookup zone with A records for each VCF management appliance and Amazon EVS host in your deployment as detailed in [Create an Amazon EVS environment](./getting-started.html#getting-started-create-env). + + * A reverse lookup zone with PTR records for each VCF management appliance and Amazon EVS host in your deployment as detailed in [Create an Amazon EVS environment](./getting-started.html#getting-started-create-env). + + + + +For NTP configuration, you can use the the default Amazon NTP address `169.254.169.123`, or another IPv4 address that you prefer. + @@ -223,0 +241,8 @@ For more information about Amazon EVS supported options for DNS and NTP server c +## Create VPC Route Server infrastructure + +Amazon EVS uses Amazon VPC Route Server to to enable BGP-based dynamic routing to your VPC underlay network. For information about setting up Route Server for Amazon EVS usage, see [Set up a VPC Route Server instance with endpoints and peers](./getting-started.html#getting-started-create-rs-resources). + +## Create a transit gatway for on-premesis connectivity + +You can configure connectivity for your on-premises data center to your AWS infrastructure using AWS Direct Connect with an associated transit gateway, or using an AWS Site-to-Site VPN attachment to a transit gateway. For more information, see [(Optional) Configure on-premises network connectivity](./getting-started.html#getting-started-connect-on-prem). +