AWS res high security documentation change
Summary
Restructured snapshot documentation by removing detailed steps for creating/applying snapshots and S3 bucket policies, replacing them with links to separate pages.
Security assessment
The change removes explicit security-critical S3 bucket policies, including the 'AllowSSLRequestsOnly' policy that enforced SSL/TLS for data transmission. This could lead to insecure bucket configurations if users are no longer guided to implement these protections. The removal of these policies from the documentation introduces a risk of data exposure via unencrypted connections.
Diff
diff --git a/res/archive/release-minus-4/ug/snapshots.md b/res/archive/release-minus-4/ug/snapshots.md index 41544ffa2..874804602 100644 --- a//res/archive/release-minus-4/ug/snapshots.md +++ b//res/archive/release-minus-4/ug/snapshots.md @@ -5,2 +4,0 @@ -Create a snapshotApply a snapshot - @@ -13 +11 @@ Snapshot management simplifies the process of saving and migrating data between -From the Snapshot management page, you can: +From the **Snapshot management** page, you can: @@ -26,179 +24 @@ From the Snapshot management page, you can: -## Create a snapshot - -Before you can create a snapshot, you must provide an Amazon S3 bucket with the necessary permissions. For information on creating a bucket, see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html). We recommend enabling bucket versioning and server access logging. These settings can be enabled from the bucket's **Properties** tab after provisioning. - -###### Note - -This Amazon S3 bucket's lifecycle will not be managed within the product. You will need to manage the bucket lifecycle from the console. - -###### To add permissions to the bucket: - - 1. Choose the bucket you created from the **Buckets** list. - - 2. Choose the **Permissions** tab. - - 3. Under **Bucket policy** , choose **Edit**. - - 4. Add the following statement to the bucket policy. Replace these values with your own: - - * `111122223333` -> your AWS Account ID - - * `{RES_ENVIRONMENT_NAME}` -> your RES environment name - - * `us-east-1` -> your AWS region - - * `amzn-s3-demo-bucket` -> your S3 bucket name - -###### Important - -There are limited version strings supported by AWS. For more information, see <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html> - -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "Export-Snapshot-Policy", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:role/{RES_ENVIRONMENT_NAME}-cluster-manager-role-us-east-1}" - }, - "Action": [ - "s3:GetObject", - "s3:ListBucket", - "s3:AbortMultipartUpload", - "s3:PutObject", - "s3:PutObjectAcl" - ], - "Resource": [ - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/*" - ] - }, - { - "Sid": "AllowSSLRequestsOnly", - "Action": "s3:*", - "Effect": "Deny", - "Resource": [ - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/*" - ], - "Condition": { - "Bool": { - "aws:SecureTransport": "false" - } - }, - "Principal": "*" - } - ] - } - - - - - -###### To create the snapshot: - - 1. Choose **Create Snapshot**. - - 2. Enter the name of the Amazon S3 bucket you created. - - 3. Enter the path where you would like the snapshot stored within the bucket. For example, `october2023/23`. - - 4. Choose **Submit**. - - - - 5. After five to ten minutes, choose **Refresh** on the Snapshots page to check the status. A snapshot will not be valid until the status changes from IN_PROGRESS to COMPLETED. - - - - -## Apply a snapshot - -Once you have created a snapshot of an environment, you can apply that snapshot to a new environment to migrate data. You will need to add a new policy to the bucket allowing the environment to read the snapshot. - -Applying a snapshot copies data such as user permissions, projects, software stacks, permission profiles, and file systems with their associations to a new environment. User sessions will not be replicated. When the snapshot is applied, it checks the basic information of each resource record to determine if it already exists. For duplicate records, the snapshot skips resource creation in the new environment. For records that are similar, such as share a name or key, but other basic resource information varies, it will create a new record with a modified name and key using the following convention: `RecordName_SnapshotRESVersion_ApplySnapshotID`. The `ApplySnapshotID` looks like a timestamp and identifies each attempt to apply a snapshot. - -During the snapshot application, the snapshot checks for the availability of resources. Resource not available to the new environment will not be created. For resources with a dependent resource, the snapshot checks for the availability of the dependent resource. If the dependent resource is not available, it will create the main resource without the dependent resource. - -If the new environment is not as expected or fails, you can check the CloudWatch logs found in the log group `/res-<env-name>/cluster-manager` for details. Each log will have the [apply snapshot] tag. Once you have applied a snapshot, you can check its status from the [Snapshot management](./snapshots.html) page. - -###### To add permissions to the bucket: - - 1. Choose the bucket you created from the **Buckets** list. - - 2. Choose the **Permissions** tab. - - 3. Under **Bucket policy** , choose **Edit**. - - 4. Add the following statement to the bucket policy. Replace these values with your own: - - * `111122223333` -> your AWS Account ID - - * `{RES_ENVIRONMENT_NAME}` -> your RES environment name - - * `us-east-1` -> your AWS region - - * `amzn-s3-demo-bucket` -> your S3 bucket name - -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "Export-Snapshot-Policy", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:role/{RES_ENVIRONMENT_NAME}-cluster-manager-role-us-east-1}" - }, - "Action": [ - "s3:GetObject", - "s3:ListBucket" - ], - "Resource": [ - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/*" - ] - }, - { - "Sid": "AllowSSLRequestsOnly", - "Action": "s3:*", - "Effect": "Deny", - "Resource": [ - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/*" - ], - "Condition": { - "Bool": { - "aws:SecureTransport": "false" - } - }, - "Principal": "*" - } - ] - } - - - - - -###### To apply snapshot: - - 1. Choose **Apply snapshot**. - - 2. Enter the name of the Amazon S3 bucket containing the snapshot. - - 3. Enter the file path to the snapshot within the bucket. - - 4. Choose **Submit**. +###### Topics @@ -206 +26 @@ JSON - + * [Create a snapshot](./create-snapshot.html) @@ -208 +28 @@ JSON - 5. After five to ten minutes, choose **Refresh** on the Snapshot management page to check the status. + * [Apply a snapshot](./apply-snapshot.html) @@ -219 +39 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Environment status +Onboard a file system