AWS evs documentation change
Summary
Restructured setup steps, added HCX connectivity options with IPAM/EIP requirements, expanded network ACL guidance, enhanced DNS/NTP security configurations, and updated AWS CLI commands for infrastructure setup.
Security assessment
Added explicit guidance for network ACLs to control VLAN subnet traffic (critical since EC2 security groups don't function here), security group/ACL rules for DNS/NTP (ports 53/HTTPS/SSH), and warnings about reserved EIPs to prevent misconfigurations. These changes document security best practices but do not address a specific disclosed vulnerability.
Diff
diff --git a/evs/latest/userguide/getting-started.md b/evs/latest/userguide/getting-started.md index c07abc1b1..7dc5e2f75 100644 --- a//evs/latest/userguide/getting-started.md +++ b//evs/latest/userguide/getting-started.md @@ -5 +5 @@ -PrerequisitesCreate a VPC with subnets and route tablesConfigure the VPC main route tableConfigure DNS and NTP servers using the VPC DHCP option set(Optional) Configure on-premises network connectivitySet up a VPC Route Server instance with endpoints and peersCreate an Amazon EVS environmentVerify Amazon EVS environment creationExplicitly associate Amazon EVS VLAN subnets to a VPC route table(Optional) Configure transit gateway route tables and Direct Connect prefixes for on-premises connectivityCreate a network ACL to control Amazon EVS VLAN subnet trafficRetrieve VCF credentials and access VCF management appliancesConfigure the EC2 Serial ConsoleClean upNext steps +PrerequisitesCreate a VPC with subnets and route tablesChoose your HCX connectivity optionConfigure the VPC main route tableConfigure DNS and NTP servers using the VPC DHCP option setSet up a VPC Route Server instance with endpoints and peersCreate a network ACL to control Amazon EVS VLAN subnet trafficCreate an Amazon EVS environmentVerify Amazon EVS environment creationExplicitly associate Amazon EVS VLAN subnets to a VPC route tableRetrieve VCF credentials and access VCF management appliancesClean upNext steps @@ -26,0 +27,2 @@ Amazon EVS only supports VCF version 5.2.1.x at this time. + * Choose your HCX connectivity option + @@ -31,2 +32,0 @@ Amazon EVS only supports VCF version 5.2.1.x at this time. - * (Optional) Configure on-premises network connectivity - @@ -34,0 +35,2 @@ Amazon EVS only supports VCF version 5.2.1.x at this time. + * Create a network ACL to control Amazon EVS VLAN subnet traffic + @@ -41,4 +42,0 @@ Amazon EVS only supports VCF version 5.2.1.x at this time. - * (Optional) Configure transit gateway route tables and Direct Connect prefixes for on-premises connectivity - - * Create a network ACL to control Amazon EVS VLAN subnet traffic - @@ -47,2 +44,0 @@ Amazon EVS only supports VCF version 5.2.1.x at this time. - * Configure the EC2 Serial Console - @@ -65,0 +62,3 @@ The VPC, subnets, and Amazon EVS environment must all be created in the same acc +Amazon VPC console + + @@ -74 +73 @@ The VPC, subnets, and Amazon EVS environment must all be created in the same acc - 5. For **IPv4 CIDR block** , enter an IPv4 CIDR block. A VPC must have an IPv4 CIDR block. Ensure that you create a VPC that is adequately sized to accommodate the Amazon EVS subnets. For more information, see [Amazon EVS networking considerations](./architecture.html#evs-subnets) + 5. For **IPv4 CIDR block** , enter an IPv4 CIDR block. A VPC must have an IPv4 CIDR block. Ensure that you create a VPC that is adequately sized to accommodate the Amazon EVS subnets. For more information, see [Amazon EVS networking considerations](./architecture.html#evs-subnets). @@ -128,0 +128,400 @@ During VPC creation, Amazon VPC automatically creates a main route table and imp +AWS CLI + + + 1. Open a terminal session. + + 2. Create a VPC with a private subnet and optional public subnet in a single Availability Zone. + + aws ec2 create-vpc \ + --cidr-block 10.0.0.0/16 \ + --instance-tenancy default \ + --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=evs-vpc}]' + --- + . Store the VPC ID for use in subsequent commands. + + + [source,bash] + +VPC_ID=$(aws ec2 describe-vpcs \ \--filters Name=tag:Name,Values=evs-vpc \ \--query 'Vpcs[0].VpcId' \ \--output text) \--- + + 3. Enable DNS hostnames and DNS support. + + aws ec2 modify-vpc-attribute \ + --vpc-id $VPC_ID \ + --enable-dns-hostnames + aws ec2 modify-vpc-attribute \ + --vpc-id $VPC_ID \ + --enable-dns-support + + 4. Create a private subnet in the VPC. + + aws ec2 create-subnet \ + --vpc-id $VPC_ID \ + --cidr-block 10.0.1.0/24 \ + --availability-zone us-west-2a \ + --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=evs-private-subnet}]' + + 5. Store the private subnet ID for use in subsequent commands. + + PRIVATE_SUBNET_ID=$(aws ec2 describe-subnets \ + --filters Name=tag:Name,Values=evs-private-subnet \ + --query 'Subnets[0].SubnetId' \ + --output text) + + 6. (Optional) Create a public subnet if internet connectivity is needed. + + aws ec2 create-subnet \ + --vpc-id $VPC_ID \ + --cidr-block 10.0.0.0/24 \ + --availability-zone us-west-2a \ + --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=evs-public-subnet}]' + + 7. (Optional) Store the public subnet ID for use in subsequent commands. + + PUBLIC_SUBNET_ID=$(aws ec2 describe-subnets \ + --filters Name=tag:Name,Values=evs-public-subnet \ + --query 'Subnets[0].SubnetId' \ + --output text) + + 8. (Optional) Create and attach an internet gateway if the public subnet is created. + + aws ec2 create-internet-gateway \ + --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=evs-igw}]' + + IGW_ID=$(aws ec2 describe-internet-gateways \ + --filters Name=tag:Name,Values=evs-igw \ + --query 'InternetGateways[0].InternetGatewayId' \ + --output text) + + aws ec2 attach-internet-gateway \ + --vpc-id $VPC_ID \ + --internet-gateway-id $IGW_ID + + 9. (Optional) Create a NAT gateway if internet connectivity is needed. + + aws ec2 allocate-address \ + --domain vpc \ + --tag-specifications 'ResourceType=elastic-ip,Tags=[{Key=Name,Value=evs-nat-eip}]' + + EIP_ID=$(aws ec2 describe-addresses \ + --filters Name=tag:Name,Values=evs-nat-eip \ + --query 'Addresses[0].AllocationId' \ + --output text) + + aws ec2 create-nat-gateway \ + --subnet-id $PUBLIC_SUBNET_ID \ + --allocation-id $EIP_ID \ + --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=evs-nat}]' + + 10. Create and configure the necessary route tables. + + aws ec2 create-route-table \ + --vpc-id $VPC_ID \ + --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=evs-private-rt}]' + + PRIVATE_RT_ID=$(aws ec2 describe-route-tables \ + --filters Name=tag:Name,Values=evs-private-rt \ + --query 'RouteTables[0].RouteTableId' \ + --output text) + + aws ec2 create-route-table \ + --vpc-id $VPC_ID \ + --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=evs-public-rt}]' + + PUBLIC_RT_ID=$(aws ec2 describe-route-tables \ + --filters Name=tag:Name,Values=evs-public-rt \ + --query 'RouteTables[0].RouteTableId' \ + --output text) + + 11. Add the necessary routes to the route tables. + + aws ec2 create-route \ + --route-table-id $PUBLIC_RT_ID \ + --destination-cidr-block 0.0.0.0/0 \ + --gateway-id $IGW_ID + + aws ec2 create-route \ + --route-table-id $PRIVATE_RT_ID \ + --destination-cidr-block 0.0.0.0/0 \ + --nat-gateway-id $NAT_GW_ID + + 12. Associate the route tables with your subnets. + + aws ec2 associate-route-table \ + --route-table-id $PRIVATE_RT_ID \ + --subnet-id $PRIVATE_SUBNET_ID + + aws ec2 associate-route-table \ + --route-table-id $PUBLIC_RT_ID \ + --subnet-id $PUBLIC_SUBNET_ID + +###### Note + +During VPC creation, Amazon VPC automatically creates a main route table and implicitly associates subnets to it by default. + + + + +## Choose your HCX connectivity option + +Select one connectivity option for your Amazon EVS environment: + + * **Private connectivity** : Provides high-performance network pathways for HCX, optimizing reliability and consistency. Requires use of AWS Direct Connect or Site-to-Site VPN for external network connectivity. + + * **Internet connectivity** : Uses the public internet to establish a flexible migration path that is quick to set up. Requires use of VPC IP Address Manager (IPAM) and Elastic IP addresses. + + + + +For detailed analysis, see [HCX connectivity options](./migrate-evs-hcx.html#migrate-evs-hcx-connectivity). + +**Choose your option:** + + * **Option A: Private connectivity only** → Continue to Configure the VPC main route table. + + * **Option B: Internet connectivity** → Continue to HCX internet connectivity setup. + + + + +###### Note + +Skip this section if you chose HCX private connectivity and continue to Configure the VPC main route table. + +To enable HCX internet connectivity for Amazon EVS, you must: + + * Ensure that your VPC IP Address Manager (IPAM) quota for Amazon-provided contiguous public IPv4 CIDR block netmask length is /28 or greater. + +###### Important +