AWS fsx documentation change
Summary
Updated network configuration documentation with IPv4/IPv6 dual-stack support, clarified subnet selection for Multi-AZ/Single-AZ deployments, and added IPv6 endpoint address range options
Security assessment
Changes focus on adding IPv6 support and clarifying network configuration steps without mentioning security vulnerabilities or exploits. While IPv6 implementation can have security implications, the documentation changes are feature-focused rather than addressing specific security issues.
Diff
diff --git a/fsx/latest/ONTAPGuide/creating-file-systems.md b/fsx/latest/ONTAPGuide/creating-file-systems.md index 306f399ea..d1a6cf560 100644 --- a//fsx/latest/ONTAPGuide/creating-file-systems.md +++ b//fsx/latest/ONTAPGuide/creating-file-systems.md @@ -67 +67,3 @@ Throughput capacity is the sustained speed at which the file server that hosts y - * Specify a **Subnet** for your file server. If you are creating a Multi-AZ file system, also choose a **Standby subnet** for the standby file server. + * (Multi-AZ only) For **Preferred subnet** , choose any value from the list of available subnets. Also choose a **Standby subnet** for the standby file server. + + * (Single-AZ only) For **Subnet** , choose any value from the list of available subnets. @@ -75,5 +77 @@ Amazon FSx manages these route tables for Multi-AZ file systems using tag-based - * (Multi-AZ only) **Endpoint IP address range** specifies the IP address range in which the endpoints to access your file system are created. - -You have three options for the endpoint IP address range: - - * **Unallocated IP address range from your VPC** – Amazon FSx chooses the last 64 IP addresses from the VPC’s primary CIDR range to use as the endpoint IP address range for the file system. This range is shared across multiple file systems if you choose this option multiple times. + * For **Network type** , select either **IPv4** (for only IPv4 support) or **Dual-stack** (for both IPv4 and IPv6 support). You can change the network type of an existing file system at any time. For more information, see [Changing network type](./manage-network-type.html#change-network-type). @@ -83,3 +81 @@ You have three options for the endpoint IP address range: -This option is grayed out if any of the last 64 IP addresses in a VPC's primary CIDR range are in use by a subnet. In this case, you can still choose an in-VPC address range (that is, a range that's not at the end of your primary CIDR range or a range that's in a secondary CIDR of your VPC) by choosing the **Enter an IP address range** option. - - * For **Preferred subnet** , specify a **Subnet** for your file server. If you are creating a Multi-AZ file system, also choose a **Standby subnet** for the standby file server. +If you intend to create an FSx for ONTAP file system that uses dual-stack mode, you must first assign an Amazon-provided IPv6 CIDR block to your VPC and subnets. For more information, see [Add IPv6 support for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-migrate-ipv6-add.html) in the _Amazon Virtual Private Cloud User Guide_. @@ -87 +83 @@ This option is grayed out if any of the last 64 IP addresses in a VPC's primary - * (Multi-AZ only) For **VPC route tables** , specify the VPC route tables to create your file system's endpoints. Select all VPC route tables associated with the subnets in which your clients are located. By default, Amazon FSx selects your VPC's default route table. + * (Multi-AZ only) **Endpoint IPv4 address range** specifies the IPv4 address range in which the endpoints to access your file system are created. @@ -89 +85 @@ This option is grayed out if any of the last 64 IP addresses in a VPC's primary - * (Multi-AZ only) **Endpoint IP address range** specifies the IP address range in which the endpoints to access your file system are created. +You have three options for the endpoint IPv4 address range: @@ -91,3 +87 @@ This option is grayed out if any of the last 64 IP addresses in a VPC's primary -You have three options for the endpoint IP address range: - - * **Unallocated IP address range from your VPC** – Amazon FSx chooses the last 64 IP addresses from the VPC’s primary CIDR range to use as the endpoint IP address range for the file system. This range is shared across multiple file systems if you choose this option multiple times. + * **Unallocated IPv4 address range from your VPC** – Amazon FSx chooses the last 64 IP addresses from the VPC’s primary CIDR range to use as the endpoint IPv4 address range for the file system. This range is shared across multiple file systems if you choose this option multiple times. @@ -99 +93 @@ This option is grayed out if any of the last 64 IP addresses in a VPC's primary - * **Floating IP address range outside your VPC** – Amazon FSx chooses a 198.19.x.0/24 address range that isn't already used by any other file systems with the same VPC and route tables. + * **Floating IPv4 address range outside your VPC** – Amazon FSx chooses a 198.19.x.0/24 address range that isn't already used by any other file systems with the same VPC and route tables. @@ -101 +95 @@ This option is grayed out if any of the last 64 IP addresses in a VPC's primary - * **Enter an IP address range** – You can provide a CIDR range of your own choosing. The IP address range that you choose can either be inside or outside the VPC’s IP address range, as long as it doesn't overlap with any subnet. + * **Enter an IPv4 address range** – You can provide a CIDR range of your own choosing. The IPv4 address range that you choose can either be inside or outside the VPC’s IP address range, as long as it doesn't overlap with any subnet. @@ -118,0 +113,6 @@ Do not choose any range that falls within the following CIDR ranges, as they are + * (Multi-AZ and dual-stack only) **Endpoint IPv6 address range** specifies the IPv6 address range in which the endpoints to access your file system are created. You have two options for the endpoint IPv6 address range: + + * **Unallocated IPv6 address range from your VPC** – Amazon FSx chooses a block of 1024 available IPv6 addresses from one of the VPC’s IPv6 CIDR ranges to use as the endpoint IPv6 address range for the file system. + + * **Enter an IPv6 address range** – You can provide an IPv6 CIDR range of your own choosing. The IPv6 address range that you choose can either be inside or outside the VPC’s IPv6 address range, as long as it doesn't overlap with any subnet. + @@ -145 +145 @@ If you want to join your SVM to a self-managed Active Directory domain, choose * - * **DNS server IP addresses** – The IPv4 addresses of the Domain Name System (DNS) servers for your domain. + * **DNS server IP addresses** – The IPv4 or IPv6 addresses of the Domain Name System (DNS) servers for your domain.