AWS filegateway medium security documentation change
Summary
Updated migration instructions to include gateway version update steps, added SMB Guest Access password re-entry requirement, and restructured migration process details
Security assessment
The addition of step 16 requiring re-entry of SMB Guest Access passwords addresses authentication continuity during migration, preventing potential unauthorized access if credentials were not properly maintained. This directly relates to security by ensuring authentication methods remain valid post-migration.
Diff
diff --git a/filegateway/latest/files3/migrate-data.md b/filegateway/latest/files3/migrate-data.md index a1800a036..f9aa45170 100644 --- a//filegateway/latest/files3/migrate-data.md +++ b//filegateway/latest/files3/migrate-data.md @@ -19 +19 @@ If you need to [log into your new Storage Gateway local console](./LocalConsole- -Use these migration instructions only for gateway appliances version 1.x or lower. You can't use them to migrate to version 2.x or higher. +Use these instructions only for migrating gateway appliances running version 1.x. You can't use them to migrate gateway appliances running lower versions. @@ -43 +43 @@ Migration can only be performed between gateways of the same type. For example, - 2. Verify that the `CachePercentDirty` metric on the **Monitoring** tab for the existing S3 File Gateway is `0`. + 2. Use the following steps to update the gateway to the latest version @@ -45 +45 @@ Migration can only be performed between gateways of the same type. For example, - 3. Shut down the existing S3 File Gateway by powering off the host virtual machine (VM) using its hypervisor controls. + 1. Open the Storage Gateway console at [https://console.aws.amazon.com/storagegateway/home](https://console.aws.amazon.com/storagegateway/). @@ -47 +47,9 @@ Migration can only be performed between gateways of the same type. For example, -For more information about shutting down an Amazon EC2 instance, see [Stop and start your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html) in the _Amazon EC2 User Guide_. + 2. In the navigation pane, choose **Gateways** , and then choose the old S3 File Gateway that you want to migrate. + + 3. Click **Update Now** if available. If not, your gateway is already on the latest version. + + 3. Verify that the `CachePercentDirty` metric on the **Monitoring** tab for the existing S3 File Gateway is `0`. + + 4. Shut down the existing S3 File Gateway by powering off the host virtual machine (VM) using its hypervisor controls. + +For more information about shutting down an Amazon EC2 instance, see [Stop and start your instance](https://docs.aws.amazon.com//AWSEC2/latest/UserGuide/Stop_Start.html) in the _Amazon EC2 User Guide_. @@ -51 +59 @@ For more information about shutting down a KVM, VMware, or Hyper-V VM, see your - 4. Detach all disks, including the root disk and cache disks from the old gateway VM. + 5. Detach all disks, including the root disk and cache disks from the old gateway VM. @@ -57 +65 @@ Make a note of the root disk's volume ID, as well as the gateway ID associated w -If you are using an Amazon EC2 instance as the VM for your S3 File Gateway, see [Detach an Amazon EBS volume from a Windows instance](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ebs-detaching-volume.html) or [Detach an Amazon EBS volume from a Linux instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.html) in the _Amazon EC2 User Guide_. +If you are using an Amazon EC2 instance as the VM for your S3 File Gateway, see [Detach an Amazon EBS volume from a Windows instance](https://docs.aws.amazon.com//AWSEC2/latest/WindowsGuide/ebs-detaching-volume.html) or [Detach an Amazon EBS volume from a Linux instance](https://docs.aws.amazon.com//AWSEC2/latest/UserGuide/ebs-detaching-volume.html) in the _Amazon EC2 User Guide_. @@ -61 +69 @@ For information about detaching disks from a KVM, VMware, or Hyper-V VM, see the - 5. Create a new AWS Storage Gateway hypervisor VM instance, but don't activate it as a gateway. In a later step, this new VM will assume the identity of the old gateway. + 6. Create a new AWS Storage Gateway hypervisor VM instance, but don't activate it as a gateway. In a later step, this new VM will assume the identity of the old gateway. @@ -69 +77 @@ Do not add cache disks for the new VM. This VM will use the same cache disks tha - 6. Configure your new Storage Gateway VM to use the same network settings as the old VM. + 7. Configure your new Storage Gateway VM to use the same network settings as the old VM. @@ -73 +81 @@ The default network configuration for the gateway is Dynamic Host Configuration -If you need to manually configure a static IP address for your gateway VM, see [Configuring network parameters](https://docs.aws.amazon.com/filegateway/latest/files3/appliance-configure-ip.html). +If you need to manually configure a static IP address for your gateway VM, see [Configuring network parameters](https://docs.aws.amazon.com//filegateway/latest/files3/appliance-configure-ip.html). @@ -75 +83 @@ If you need to manually configure a static IP address for your gateway VM, see [ -If your gateway VM must use a Socket Secure version 5 (SOCKS5) proxy to connect to the internet, see [Routing your gateway deployed on EC2 through an HTTP proxy](https://docs.aws.amazon.com/filegateway/latest/files3/ec2-local-console-fwg.html#EC2_MaintenanceRoutingProxy-fgw). +If your gateway VM must use a Socket Secure version 5 (SOCKS5) proxy to connect to the internet, see [Routing your gateway deployed on EC2 through an HTTP proxy](https://docs.aws.amazon.com//filegateway/latest/files3/ec2-local-console-fwg.html#EC2_MaintenanceRoutingProxy-fgw). @@ -77 +85 @@ If your gateway VM must use a Socket Secure version 5 (SOCKS5) proxy to connect - 7. Start the new Storage Gateway VM. + 8. Start the new Storage Gateway VM. @@ -79 +87 @@ If your gateway VM must use a Socket Secure version 5 (SOCKS5) proxy to connect - 8. Attach the disks that you detached from the old gateway VM to the new gateway VM. Do not detach the existing root disk from the new gateway VM. + 9. Attach the disks that you detached from the old gateway VM to the new gateway VM. Do not detach the existing root disk from the new gateway VM. @@ -85 +93,3 @@ To migrate successfully, all disks must remain unchanged. Changing the disk size - 9. Initiate the gateway migration process by connecting to the new VM with a URL that uses the following format: + 10. Initiate the gateway migration process by either connecting to the new gateway VM’s local console, or making web requests to the new gateway VM's IP address (described below). + + 1. To use the local console, select the option for **Migrate Gateway** and provide your existing gateway ID when prompted. You will be provided prompts to copy previously applied settings on old gateway to the new gateway. You may choose to apply them or manually configure them later. See [Accessing the Gateway Local Console](https://docs.aws.amazon.com/filegateway/latest/files3/accessing-local-console.html). @@ -87 +97 @@ To migrate successfully, all disks must remain unchanged. Changing the disk size -`http://`your-VM-IP-address`/migrate?gatewayId=`your-gateway-ID`` + 2. Alternatively, you can initiate the gateway migration process by connecting to the new VM with a URL that uses the following format. @@ -89 +99 @@ To migrate successfully, all disks must remain unchanged. Changing the disk size -You can use the same IP address for the new gateway VM that you used for the old gateway VM. To use the same IP, delete the old gateway first and then proceed from step 5. Your URL should look similar to the following example: + http://your-VM-IP-address/migrate?gatewayId=your-gateway-ID @@ -91 +101 @@ You can use the same IP address for the new gateway VM that you used for the old -`http://`198.51.100.123`/migrate?gatewayId=`sgw-12345678`` +You can re-use the same IP address for the new gateway VM as you used for the old gateway VM. Your URL should look similar to the example following. @@ -93 +103 @@ You can use the same IP address for the new gateway VM that you used for the old -Use this URL from a browser, or from the command line using cURL. + http://198.51.100.123/migrate?gatewayId=sgw-12345678 @@ -95 +105 @@ Use this URL from a browser, or from the command line using cURL. -When the gateway migration initiates successfully, the following message appears: +Use this URL from a browser, or from the command line using `curl`, to initiate the migration process. @@ -97 +107 @@ When the gateway migration initiates successfully, the following message appears - Successfully imported Storage Gateway information. Please refer to Storage Gateway documentation to perform the next steps to complete the migration. +When the gateway migration process is successfully completed, you will see a message confirming successful migration. @@ -99 +109 @@ When the gateway migration initiates successfully, the following message appears - 10. Wait for the gateway status to show as **Running** in the AWS Storage Gateway console. Depending on available bandwidth, this can take up to 10 minutes. + 11. Wait for the gateway status to show as **Running** in the AWS Storage Gateway console. Depending on available bandwidth, this can take up to 10 minutes. @@ -101 +111 @@ When the gateway migration initiates successfully, the following message appears - 11. Stop the new Storage Gateway VM. + 12. Stop the new Storage Gateway VM. @@ -103 +113 @@ When the gateway migration initiates successfully, the following message appears - 12. Detach the old gateway's root disk, whose volume ID you noted previously, from the new gateway. + 13. Detach the old gateway's root disk, whose volume ID you noted previously, from the new gateway. @@ -105 +115 @@ When the gateway migration initiates successfully, the following message appears - 13. Start the new Storage Gateway VM. + 14. Start the new Storage Gateway VM. @@ -107 +117 @@ When the gateway migration initiates successfully, the following message appears - 14. If your gateway was joined to an Active Directory domain, re-join the domain. For instructions, see [Using Active Directory to authenticate users](https://docs.aws.amazon.com/filegateway/latest/files3/enable-ad-settings.html). + 15. If your gateway was joined to an Active Directory domain, re-join the domain. For instructions, see [Using Active Directory to authenticate users](https://docs.aws.amazon.com//filegateway/latest/files3/enable-ad-settings.html). @@ -113 +123,3 @@ You must complete this step even if the status of the S3 File Gateway appears as - 15. Confirm that your shares are available at the new gateway VM's IP address, then delete the old gateway VM. + 16. If your gateway was using the SMB Guest Access authentication method, the password will need to be reentered. For instructions see [Provide guest access to your file share](https://docs.aws.amazon.com/filegateway/latest/files3/guest-access.html). + + 17. Confirm that your shares are available at the new gateway VM's IP address, then delete the old gateway VM. @@ -119 +131 @@ When a gateway is deleted, there is no way to recover it. -For more information about deleting an Amazon EC2 instance, see [Terminate your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html) in the _Amazon EC2 User Guide_. For more information about deleting a KVM, VMware, or Hyper-V VM, see the documentation for your hypervisor. +For more information about deleting an Amazon EC2 instance, see [Terminate your instance](https://docs.aws.amazon.com//AWSEC2/latest/UserGuide/terminating-instances.html) in the _Amazon EC2 User Guide_. For more information about deleting a KVM, VMware, or Hyper-V VM, see the documentation for your hypervisor.