AWS transform medium security documentation change
Summary
Added network configuration generators (Terraform/CDK), security group rules, and checksum verification guidance
Security assessment
Explicitly adds checksum verification instructions to detect file tampering during transfer, addressing data integrity security concerns. Also documents security group rules and tagging practices.
Diff
diff --git a/transform/latest/userguide/transform-vmware-migrate-network.md b/transform/latest/userguide/transform-vmware-migrate-network.md index 160a355f9..d8b368a09 100644 --- a//transform/latest/userguide/transform-vmware-migrate-network.md +++ b//transform/latest/userguide/transform-vmware-migrate-network.md @@ -5 +5 @@ -Network topologiesIP migration approachesGenerate VPC configurationTag network resourcesSecurity group association +Network configuration generatorsNetwork topologiesIP migration approachesGenerate VPC configurationTag network resourcesSecurity group association @@ -37,0 +38,60 @@ Once the target network is generated, review the generated network configuration +## Network configuration generators + +AWS Transform provides multiple generators for creating network infrastructure code from your migrated network configuration. These are available to you in the **Migrate Network** task, after you **Generate VPC configuration** and **Review generated VPC configuration**. When you choose the **Deploy on my own** option, in addition to AWS CloudFormation template options you can choose: + + * **HashiCorp Terraform** \- Infrastructure as Code (IaC) templates generated in HashiCorp Configuration Language (HCL) for managing network resources + + * **CDK project** \- AWS Cloud Development Kit (AWS CDK) templates generated in TypeScript for programmatic infrastructure deployment + + + + +After you select a network configuration format, use the link provided on the **Download and deploy networks** \- **Collaboration** tab to download a zip file containing the generated templates. The zip folder includes a README.md file that explains how to use the generated templates. + +###### Note + +To ensure that the downloaded file hasn’t been corrupted or tampered with during transfer, generate and download a checksum from **Optional tasks** and compare the hash to a locally generated hash. Generate the local hash using the `openssl dgst -sha256 -binary <file.zip> | base64` command. + +The network configuration generators generate these key components: + +### Hub and Spoke Network Architecture + + * **Transit Gateway Hub:** Central routing point connecting all VPC segments + + * **Multiple VPC Spokes:** Network segments for different workload types + + * **Centralized Traffic Control:** Inspection, outbound, and inbound VPCs for traffic filtering + + + + +### Network Segments Configuration + +The infrastructure creates VPC segments for organizing workloads and managing network traffic flow. + +### Security Configuration + + * **Comprehensive Security Groups:** Pre-configured rules for different network segments + + * **Network Definitions:** CIDR block definitions for consistent referencing + + * **Rule Templates:** Modular security rules supporting ingress/egress traffic control + + + + +### Application Migration Service Integration + + * **Automatic Tagging:** All resources tagged with MGN definition and execution IDs + + * **Migration Tracking:** Resources tagged for Application Migration Service tracking + + * **Execution Context:** Unique execution ID for deployment correlation + + + + +### Reusable Modules + +The generated configuration includes a modular structure for maintainability and reusability + @@ -111 +171 @@ Review the results and then choose to continue with network deployment or to rep -For AWS Transform to launch Amazon EC2 instances within your existing AWS network resources which were not created by AWS Transform, the target network resources, including VPCs and subnets, must be tagged. You can ask AWS Transform to do the tagging for you, in which case it will tag **all** network resources that it finds in the target AWS account and AWS Region. You can also manually tag target network resources that you’ve created on your own with the following tags: +For AWS Transform to launch Amazon EC2 instances within your existing AWS network resources which were not created by AWS Transform, the target network resources, including VPCs and subnets, must be tagged. You can ask AWS Transform to do the tagging for you, in which case it tags **all** network resources that it finds in the target AWS account and AWS Region. You can also manually tag target network resources that you’ve created on your own with the following tags: @@ -115 +175,5 @@ Key: `CreatedFor` Value: `AWSTransform` -Key: `ATWorkspace ` Value: `AWS Transform workspace the connector will be used in` +Key: `ATWorkspace ` Value: `workspace ID` + +Find your workspace ID in the AWS Transform web app URL, https:// ... /workspace/`workspace-id`/job/job-id + +Learn more about how to tag network resources in [Tag your VPCs and subnets](./transform-vmware-migrate-waves.html#transform-tag-vpc-subnets) .