AWS evs medium security documentation change
Summary
Expanded HCX migration documentation with connectivity options (private/public), architecture diagrams, detailed prerequisites, and security considerations for network ACLs/EIP management
Security assessment
Added explicit warnings about EC2 security groups not functioning on EVS VLAN subnets (requiring NACLs instead), highlighted risks of public EIP associations enabling direct internet access, and emphasized proper ACL configuration to restrict exposure. These changes address security misconfiguration risks inherent in public connectivity setups.
Diff
diff --git a/evs/latest/userguide/migrate-evs-hcx.md b/evs/latest/userguide/migrate-evs-hcx.md index efbed9185..703a87fa3 100644 --- a//evs/latest/userguide/migrate-evs-hcx.md +++ b//evs/latest/userguide/migrate-evs-hcx.md @@ -5 +5 @@ -PrerequisitesCheck the status of the HCX VLAN subnetCheck that the HCX VLAN subnet is associated with a network ACLCreate a distributed port group with the HCX public uplink VLAN ID(Optional) Set up HCX WAN Optimization(Optional) Enable HCX Mobility Optimized NetworkingVerify HCX connectivity +HCX connectivity optionsHCX private connectivity architectureHCX internet connectivity architectureHCX migration setup @@ -7 +7,97 @@ PrerequisitesCheck the status of the HCX VLAN subnetCheck that the HCX VLAN subn -# Migrate workloads to Amazon EVS using VMware Hybrid Cloud Extension (VMware HCX) +# Migrate workloads to Amazon EVS using VMware HCX + +After Amazon EVS is deployed, you can deploy VMware HCX with private or public internet connectivity to facilitate migration of workloads to Amazon EVS. For more information, see [Getting Started with VMware HCX](https://techdocs.broadcom.com/us/en/vmware-cis/hcx/vmware-hcx/4-10/getting-started-with-vmware-hcx-4-10.html) in the _VMware HCX User Guide_. + +###### Important + +HCX internet-based migration is generally not recommended for: + + * Applications sensitive to network jitter or latency. + + * Time-critical vMotion operations. + + * Large-scale migrations with strict performance requirements. + + + + +For these scenarios, we recommend using HCX private connectivity. A private dedicated connection offers more reliable performance compared to internet-based connections. + +###### Note + +The workload migration process has been tested and verified with VMware Cloud Foundation (VCF) 5.2.1 and VMware HCX 4.10. + +## HCX connectivity options + +You can migrate workloads to Amazon EVS using private connectivity with AWS Direct Connect or Site-to-Site VPN connection, or using public connectivity. + +Depending on your situation and connectivity options, you may prefer to use public or private connectivity with HCX. For example, some sites may have private connectivity with greater performance consistency, but lower throughput due to VPN encryption or limited link speeds. Likewise, you may have high throughput public internet connectivity that has more variance in performance. With Amazon EVS, you have the choice to use whichever connectivity option works best for you. + +The following table compares the differences between HCX private and public connectivity. + +Private connectivity | Public connectivity +---|--- +**Overview** | **Overview** +Uses only private connections within the VPC. You can optionally use AWS Direct Connect or Site-to-Site VPN with a transit gateway for external network connectivity. | Uses public internet connectivity with Elastic IP addresses, enabling migrations without a dedicated private connection. +**Best suited for** | **Best suited for** + + * Time-sensitive vMotion operations. + * Large-scale migrations. + * Applications sensitive to latency/jitter. + * High-volume data transfers. + * Organizations with existing AWS Direct Connect/AWS Site-to-Site VPN. + +| + + * Locations without AWS Direct Connect/AWS Site-to-Site VPN. + * Cost-sensitive projects. + + +**Key benefits** | **Key benefits** + + * Consistent low-latency connectivity. + * Dedicated bandwidth allocation. + * More reliable network performance. + * Default HCX encryption can be disabled for private environments to optimize performance. + * No public IP management required. + +| + + * Faster setup than private connectivity. + * Cost-effective for smaller migrations. + + +**Key considerations** | **Key considerations** + + * More complex initial setup. + * Higher upfront infrastructure costs. + * Longer implementation timeline. + * No direct internet connectivity for any HCX component. + +| + + * More variable network performance. + * Bandwidth limitations are possible. + * Higher latency than private connectivity. + * Each component requires a dedicated Elastic IP address allocated from the public IPAM pool. + * EIP associations enable direct internet connectivity for each HCX component. + + + +## HCX private connectivity architecture + +The HCX private connectivity solution integrates several components: + + * **Amazon EVS network components** + + * Uses only private VLAN subnets for secure communication, including a private HCX VLAN. + + * Supports network ACLs for traffic control. + + * Supports dynamic BGP propagation of routes through a private VPC route server. + + * **AWS managed network transit options for on-premises connectivity** + + * AWS Direct Connect + AWS Transit Gateway enables you to connect your on-premises network to Amazon EVS over a private dedicated connection. For more information, see [AWS Direct Connect + AWS Transit Gateway](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-aws-transit-gateway.html). + + * AWS Site-to-Site VPN + AWS Transit Gateway provides the option of creating an IPsec VPN connection between your remote network and the transit gateway over the internet. For more information, see [AWS Transit Gateway + AWS Site-to-Site VPN](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-transit-gateway-vpn.html). @@ -9 +104,0 @@ PrerequisitesCheck the status of the HCX VLAN subnetCheck that the HCX VLAN subn -After you have created an Amazon EVS environment, you can migrate your existing VMware-based workloads to Amazon Elastic VMware Service (Amazon EVS) using VMware Hybrid Cloud Extension (VMware HCX). For more information about VMware HCX migration, see [VMware HCX Migration Types](https://techdocs.broadcom.com/us/en/vmware-cis/hcx/vmware-hcx/4-11/vmware-hcx-user-guide-4-11/migrating-virtual-machines-with-vmware-hcx/vmware-hcx-migration-types.html) in the _VMware HCX User Guide_. @@ -11 +105,0 @@ After you have created an Amazon EVS environment, you can migrate your existing -The following tutorial describes how to use VMware HCX to migrate a VMware workload to Amazon EVS. @@ -13 +106,0 @@ The following tutorial describes how to use VMware HCX to migrate a VMware workl -You can use VMware HCX to migrate workloads over a private connection using AWS Direct Connect with an associated transit gateway, or using an AWS Site-to-Site VPN attachment to a transit gateway. @@ -19 +112,32 @@ Amazon EVS does not support connectivity via an AWS Direct Connect private virtu -For more information about setting up an AWS Direct Connect connection, see [AWS Direct Connect gateways and transit gateway associations](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-transit-gateways.html) in the _AWS Direct Connect User Guide_. For more information about using AWS Site-to-Site VPN with AWS Transit Gateway, see [AWS Site-to-Site VPN attachments in Amazon VPC Transit Gateways](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpn-attachments.html) in the _Amazon VPC Transit Gateway User Guide_. +The following diagram illustrates the HCX private connectivity architecture, showing how you can use AWS Direct Connect and Site-to-Site VPN with the transit gateway to enable secure workload migration through a private dedicated connection. + + + +## HCX internet connectivity architecture + +The HCX internet connectivity solution consists of several components working together: + + * **Amazon EVS network components** + + * Uses an isolated public HCX VLAN subnet to enable internet connectvity between Amazon EVS and your on-premises HCX appliances. + + * Supports network ACLs for traffic control. + + * Supports dynamic BGP propagation of routes through a public VPC route server. + + * **IPAM and public IP management** + + * Amazon VPC IP Address Manager (IPAM) manages public IPv4 address allocation from the Amazon-owned public IPAM pool. + + * Secondary VPC CIDR block (/28) is allocated from the IPAM pool, creating an isolated public subnet separate from the main VPC CIDR. + + + + +For more information, see [Configure HCX public internet connectivity](./evs-env-hcx-internet-access.html). + +The following diagram illustrates the HCX internet connectivity architecture. + + + +## HCX migration setup @@ -21 +145 @@ For more information about setting up an AWS Direct Connect connection, see [AWS -## Prerequisites +This tutorial describes how to configure VMware HCX to migrate your workloads to Amazon EVS. @@ -23 +147 @@ For more information about setting up an AWS Direct Connect connection, see [AWS -Before using VMware HCX with Amazon EVS, ensure that HCX prerequisites have been met and an Amazon EVS environment has been created and connected to your on-premises network using either AWS Direct Connect with a transit gateway or AWS Site-to-Site VPN with a transit gateway. For steps to create an Amazon EVS environment, see [Getting started with Amazon Elastic VMware Service](./getting-started.html). For more information about VMware HCX prerequisites, see [VMware HCX prerequisites](./setting-up.html#hcx-prereqs). +### Prerequisites @@ -25 +149 @@ Before using VMware HCX with Amazon EVS, ensure that HCX prerequisites have been -## Check the status of the HCX VLAN subnet +Before using VMware HCX with Amazon EVS, ensure that HCX prerequisites have been met. For more information, see [VMware HCX prerequisites](./setting-up.html#hcx-prereqs). @@ -27 +151,20 @@ Before using VMware HCX with Amazon EVS, ensure that HCX prerequisites have been -Follow these steps to check that the HCX VLAN subnet is properly configured. +###### Important + +Amazon EVS has unique requirements for HCX public internet connectivity. + +If you need HCX public connectivity, you must meet the following requirements: + + * Create an IPAM and a public IPv4 IPAM pool with CIDR that has a a minimum netmask length of /28. + + * Allocate at least two Elastic IP addresses (EIPs) from the IPAM pool for the HCX Manager and HCX Interconnect (HCX-IX) appliances. Allocate an additional Elastic IP address for each HCX network appliance that you need to deploy. + + * Add the public IPv4 CIDR block as an additional CIDR to your VPC. + + + + +For more information, see [HCX internet connectivity setup](./getting-started.html#hcx-internet-config). + +### Check the status of the HCX VLAN subnet + +A VLAN is created for HCX as a part of the standard Amazon EVS deployment. Follow these steps to check that the HCX VLAN subnet is properly configured. @@ -40,3 +183 @@ Amazon EVS console - 5. Under **VLANs** , identify the HCX VLAN and check that the **State** is **Created**. - - 6. Copy the HCX `vlan` ID for later use. + 5. Under **VLANs** , identify the HCX VLAN and check that the **State** is **Created** and **Public** is **true**. @@ -54 +195 @@ AWS CLI -The following is a sample response. + 2. In the response output, identify the VLAN with a `functionName` of `hcx` and check that the `vlanState` is `CREATED` and `isPublic` is set to `true`. The following is a sample response. @@ -57 +198,13 @@ The following is a sample response. - "environmentVlans": [ + "environmentVlans": [{ + "vlanId": 50, + "cidr": "10.10.4.0/24", + "availabilityZone": "us-east-2b", + "functionName": "vTep", + "subnetId": "subnet-0ce640ac79e7f4dbc", + "createdAt": "2025-09-09T12:09:37.526000-07:00", + "modifiedAt": "2025-09-09T12:35:00.596000-07:00", + "vlanState": "CREATED", + "stateDetails": "VLAN successfully created", + "eipAssociations": [], + "isPublic": false + },