AWS res medium security documentation change
Summary
Rephrased SSH connection instructions, clarified clusteradmin password reset requirements, and restructured AWS services table with 'Type' column
Security assessment
The change explicitly requires 'clusteradmin' to reset temporary credentials on first login, which addresses credential lifecycle management and prevents persistent use of initial temporary credentials. This is a security hardening measure against credential stagnation.
Diff
diff --git a/res/archive/release-minus-4/ug/architecture-overview.md b/res/archive/release-minus-4/ug/architecture-overview.md index 0a06ea8ff..ea3401bc1 100644 --- a//res/archive/release-minus-4/ug/architecture-overview.md +++ b//res/archive/release-minus-4/ug/architecture-overview.md @@ -35 +35 @@ Amazon CloudWatch receives metrics from the eVDI components. -Administrators may connect to the bastion host component using SSH to manage the underlying infrastructure. +Administrators may use SSH to connect to the bastion host component to manage the underlying infrastructure. @@ -49 +49 @@ We recommend using AWS Certificate Manager to generate a trusted certificate for - 6. RES uses Amazon Cognito to create an initial bootstrap user called clusteradmin within and sends temporary credentials to the email address provided during installation. The clusteradmin must change the password with first-time login. + 6. RES uses Amazon Cognito to create an initial bootstrap user called 'clusteradmin' within and sends temporary credentials to the email address provided during installation. The 'clusteradmin' must change the password the first time they login. @@ -60,24 +60,24 @@ We recommend using AWS Certificate Manager to generate a trusted certificate for -AWS service | Description ----|--- -[Amazon Elastic Compute Cloud](https://aws.amazon.com/ec2/) | **Core.** Provides the underlying compute services to create virtual desktops with their chosen operating system and software stack. -[Elastic Load Balancing](https://aws.amazon.com/elasticloadbalancing/) | **Core.** Bastion, cluster-manager, and VDI hosts are created in Auto Scaling groups behind the load balancer. ELB balances traffic from the web portal across RES hosts. -[Amazon Virtual Private Cloud](https://aws.amazon.com/vpc/) | **Core.** All core product components are created within your VPC. -[Amazon Cognito](https://aws.amazon.com/cognito/) | **Core.** Manages user identities and authentication. Active Directory users are mapped to Amazon Cognito users and groups to authenticate access levels. -[Amazon Elastic File System](https://aws.amazon.com/efs/) | **Core.** Provides the `/home` file system for the file browser and VDI hosts, as well as shared external file systems. -[Amazon DynamoDB](https://aws.amazon.com/dynamodb/) | **Core.** Stores configuration data such as users, groups, projects, file systems, and component settings. -[AWS Systems Manager](https://aws.amazon.com/systems-manager/) | **Core.** Stores documents for performing commands for VDI session management. -[AWS Lambda](https://aws.amazon.com/lambda/) | **Core.** Supports product functionalities such as updating settings within the DynamoDB table, starting Active Directory sync workflows, and updating the prefix list. -[Amazon CloudWatch](https://aws.amazon.com/cloudwatch/) | **Supporting.** Provides metrics and activity logs for all Amazon EC2 hosts and Lambda functions. -[Amazon Simple Storage Service](https://aws.amazon.com/s3/) | **Supporting.** Stores application binaries for host bootstrapping and configuration. -[AWS Key Management Service](https://aws.amazon.com/kms/) | **Supporting.** Used for encryption at rest with Amazon SQS queues, DynamoDB tables, and Amazon SNS topics. -[AWS Secrets Manager](https://aws.amazon.com/secrets-manager) | **Supporting.** Stores service account credentials in Active Directory and self-signed certificates for VDIs. -[AWS CloudFormation](https://aws.amazon.com/cloudformation/) | **Supporting.** Provides a deployment mechanism for the product. -[AWS Identity and Access Management](https://aws.amazon.com/iam/) | **Supporting.** Restricts the access level for hosts. -[Amazon Route 53](https://aws.amazon.com/route53/) | **Supporting.** Creates private hosted zone for resolving the internal load balancer and the bastion host domain name. -[Amazon Simple Queue Service](https://aws.amazon.com/sqs/) | **Supporting.** Creates task queues to support asynchronous executions. -[Amazon Simple Notification Service](https://aws.amazon.com/sns/) | **Supporting.** Supports the publication-subscriber model between VDI components such as the controller and hosts. -[AWS Fargate](https://aws.amazon.com/fargate/) | **Supporting.** Installs, updates, and deletes environments using Fargate tasks. -[Amazon FSx File Gateway](https://aws.amazon.com/fsx/) | **Optional.** Provides external shared file system. -[Amazon FSx for NetApp ONTAP](https://aws.amazon.com/fsx/netapp-ontap/) | **Optional.** Provides external shared file system. -[AWS Certificate Manager](https://aws.amazon.com/certificate-manager) | **Optional.** Generates a trusted certificate for your custom domain. -[AWS Backup](https://aws.amazon.com/backup/) | **Optional.** Offers backup capabilities for Amazon EC2 hosts, file systems, and DynamoDB. +AWS service | Type | Description +---|---|--- +[Amazon Elastic Compute Cloud](https://aws.amazon.com/ec2/) | Core | Provides the underlying compute services to create virtual desktops with their chosen operating system and software stack. +[Elastic Load Balancing](https://aws.amazon.com/elasticloadbalancing/) | Core | Bastion, cluster-manager, and VDI hosts are created in Auto Scaling groups behind the load balancer. ELB balances traffic from the web portal across RES hosts. +[Amazon Virtual Private Cloud](https://aws.amazon.com/vpc/) | Core | All core product components are created within your VPC. +[Amazon Cognito](https://aws.amazon.com/cognito/) | Core | Manages user identities and authentication. Active Directory users are mapped to Amazon Cognito users and groups to authenticate access levels. +[Amazon Elastic File System](https://aws.amazon.com/efs/) | Core | Provides the `/home` file system for the file browser and VDI hosts, as well as shared external file systems. +[Amazon DynamoDB](https://aws.amazon.com/dynamodb/) | Core | Stores configuration data such as users, groups, projects, file systems, and component settings. +[AWS Systems Manager](https://aws.amazon.com/systems-manager/) | Core | Stores documents for performing commands for VDI session management. +[AWS Lambda](https://aws.amazon.com/lambda/) | Core | Supports product functionalities such as updating settings within the DynamoDB table, starting Active Directory sync workflows, and updating the prefix list. +[Amazon CloudWatch](https://aws.amazon.com/cloudwatch/) | Supporting | Provides metrics and activity logs for all Amazon EC2 hosts and Lambda functions. +[Amazon Simple Storage Service](https://aws.amazon.com/s3/) | Supporting | Stores application binaries for host bootstrapping and configuration. +[AWS Key Management Service](https://aws.amazon.com/kms/) | Supporting | Used for encryption at rest with Amazon SQS queues, DynamoDB tables, and Amazon SNS topics. +[AWS Secrets Manager](https://aws.amazon.com/secrets-manager) | Supporting | Stores service account credentials in Active Directory and self-signed certificates for VDIs. +[AWS CloudFormation](https://aws.amazon.com/cloudformation/) | Supporting | Provides a deployment mechanism for the product. +[AWS Identity and Access Management](https://aws.amazon.com/iam/) | Supporting | Restricts the access level for hosts. +[Amazon Route 53](https://aws.amazon.com/route53/) | Supporting | Creates private hosted zone for resolving the internal load balancer and the bastion host domain name. +[Amazon Simple Queue Service](https://aws.amazon.com/sqs/) | Supporting | Creates task queues to support asynchronous executions. +[Amazon Simple Notification Service](https://aws.amazon.com/sns/) | Supporting | Supports the publication-subscriber model between VDI components such as the controller and hosts. +[AWS Fargate](https://aws.amazon.com/fargate/) | Supporting | Installs, updates, and deletes environments using Fargate tasks. +[Amazon FSx File Gateway](https://aws.amazon.com/fsx/) | Optional | Provides external shared file system. +[Amazon FSx for NetApp ONTAP](https://aws.amazon.com/fsx/netapp-ontap/) | Optional | Provides external shared file system. +[AWS Certificate Manager](https://aws.amazon.com/certificate-manager) | Optional | Generates a trusted certificate for your custom domain. +[AWS Backup](https://aws.amazon.com/backup/) | Optional | Offers backup capabilities for Amazon EC2 hosts, file systems, and DynamoDB.