AWS fsx documentation change
Summary
Updated references from 'AWS VPN' to 'Site-to-Site VPN' across multiple sections to clarify VPN service terminology
Security assessment
The changes standardize terminology to use the more precise 'Site-to-Site VPN' term instead of the broader 'AWS VPN' reference. While VPN configurations impact security, this is a documentation clarification rather than a response to a specific security vulnerability or weakness. No security features were added or modified beyond terminology alignment.
Diff
diff --git a/fsx/latest/ONTAPGuide/supported-fsx-clients.md b/fsx/latest/ONTAPGuide/supported-fsx-clients.md index db9bf7f34..710ae95ed 100644 --- a//fsx/latest/ONTAPGuide/supported-fsx-clients.md +++ b//fsx/latest/ONTAPGuide/supported-fsx-clients.md @@ -142 +142 @@ Multi-AZ IPv4-only file systems created using the AWS CLI or Amazon FSx API use -Only [AWS Transit Gateway](https://aws.amazon.com/transit-gateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) supports routing to floating IP addresses, which is also known as transitive peering. VPC Peering, Direct Connect, and AWS VPN don't support transitive peering. Therefore, you are required to use Transit Gateway in order to access these interfaces from networks that are outside of your file system's VPC. +Only [AWS Transit Gateway](https://aws.amazon.com/transit-gateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) supports routing to floating IP addresses, which is also known as transitive peering. VPC Peering, Direct Connect, and Site-to-Site VPN don't support transitive peering. Therefore, you are required to use Transit Gateway in order to access these interfaces from networks that are outside of your file system's VPC. @@ -158 +158 @@ Amazon FSx manages VPC route tables for Multi-AZ file systems using tag-based au -The endpoints used to access FSx for ONTAP Single-AZ file systems over NFS or SMB, and for administering file systems using the ONTAP CLI or REST API, are secondary IP addresses on the ENI of the active file server. The secondary IP addresses are within the VPC’s CIDR range, so clients can access data and management ports using VPC Peering, AWS Direct Connect, or AWS VPN without requiring AWS Transit Gateway. +The endpoints used to access FSx for ONTAP Single-AZ file systems over NFS or SMB, and for administering file systems using the ONTAP CLI or REST API, are secondary IP addresses on the ENI of the active file server. The secondary IP addresses are within the VPC’s CIDR range, so clients can access data and management ports using VPC Peering, AWS Direct Connect, or Site-to-Site VPN without requiring AWS Transit Gateway. @@ -160 +160 @@ The endpoints used to access FSx for ONTAP Single-AZ file systems over NFS or SM -The following diagram illustrates using AWS VPN or Direct Connect for NFS, SMB, or management access to a Single-AZ file system that is in a different VPC than the clients accessing it. +The following diagram illustrates using Site-to-Site VPN or Direct Connect for NFS, SMB, or management access to a Single-AZ file system that is in a different VPC than the clients accessing it. @@ -162 +162 @@ The following diagram illustrates using AWS VPN or Direct Connect for NFS, SMB, - + @@ -189 +189 @@ You can use either VPC Peering or AWS Transit Gateway to access your file system -You can access your FSx for ONTAP file systems from on-premises using [AWS VPN](https://aws.amazon.com/vpn/) and [Direct Connect](https://aws.amazon.com/getting-started/projects/connect-data-center-to-aws/); more specific use case guidelines are available in the following sections. In addition to any requirements listed below for accessing different FSx for ONTAP resources from on-premises, you also need to ensure that your file system's VPC security group allows data to flow between your file system and clients; for a list of required ports, see [Amazon VPC security groups](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/limit-access-security-groups.html#fsx-vpc-security-groups). +You can access your FSx for ONTAP file systems from on-premises using [Site-to-Site VPN](https://aws.amazon.com/vpn/) and [Direct Connect](https://aws.amazon.com/getting-started/projects/connect-data-center-to-aws/); more specific use case guidelines are available in the following sections. In addition to any requirements listed below for accessing different FSx for ONTAP resources from on-premises, you also need to ensure that your file system's VPC security group allows data to flow between your file system and clients; for a list of required ports, see [Amazon VPC security groups](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/limit-access-security-groups.html#fsx-vpc-security-groups). @@ -199 +199 @@ Amazon FSx requires that you use AWS Transit Gateway or that you configure remot -Because the NFS, SMB, and management endpoints use floating IP addresses, you must use [AWS Transit Gateway](https://aws.amazon.com/transit-gateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) in conjunction with AWS Direct Connect or AWS VPN to access these interfaces from an on-premises network. The floating IP addresses used for these interfaces are within the `EndpointIPv4AddressRange` or `EndpointIPv6AddressRange` you specify when creating your Multi-AZ file system. The endpoint IP address range uses the following address ranges, depending on how a file system is created: +Because the NFS, SMB, and management endpoints use floating IP addresses, you must use [AWS Transit Gateway](https://aws.amazon.com/transit-gateway/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc) in conjunction with AWS Direct Connect or Site-to-Site VPN to access these interfaces from an on-premises network. The floating IP addresses used for these interfaces are within the `EndpointIPv4AddressRange` or `EndpointIPv6AddressRange` you specify when creating your Multi-AZ file system. The endpoint IP address range uses the following address ranges, depending on how a file system is created: @@ -228 +228 @@ FSx for ONTAP’s inter-cluster endpoints are dedicated to replication traffic b -Because a file system's inter-cluster endpoints use IP addresses that are within the CIDR range of the VPC you provide when you create your FSx for ONTAP file system, you are not required to use a Transit Gateway for routing inter-cluster traffic between on-premises and the AWS Cloud. However, on-premises clients still must use AWS VPN or Direct Connect to establish a secure connection to your VPC. +Because a file system's inter-cluster endpoints use IP addresses that are within the CIDR range of the VPC you provide when you create your FSx for ONTAP file system, you are not required to use a Transit Gateway for routing inter-cluster traffic between on-premises and the AWS Cloud. However, on-premises clients still must use Site-to-Site VPN or Direct Connect to establish a secure connection to your VPC.