AWS wellarchitected documentation change
Summary
Standardized VPN terminology to 'Site-to-Site VPN' and updated monitoring documentation references
Security assessment
Changes focus on naming consistency (AWS VPN → Site-to-Site VPN) and monitoring documentation links. While high-availability and monitoring are important for reliability, these updates don't address specific security vulnerabilities or introduce new security controls. Existing security context about encrypted tunnels remains unchanged.
Diff
diff --git a/wellarchitected/latest/hybrid-networking-lens/operational-excellence-pillar.md b/wellarchitected/latest/hybrid-networking-lens/operational-excellence-pillar.md index 831811c68..26a7316b2 100644 --- a//wellarchitected/latest/hybrid-networking-lens/operational-excellence-pillar.md +++ b//wellarchitected/latest/hybrid-networking-lens/operational-excellence-pillar.md @@ -62 +62 @@ Your operations team should be prepared for unplanned outages with networking wh -To ensure operational stability in case of failures, AWS VPN has built in high-availability. AWS Site-to-Site VPN connection has two tunnels, with each tunnel using a unique virtual private gateway public IP address. It is important to configure both tunnels for redundancy, if one tunnel becomes unavailable (for example, if it is down for maintenance), network traffic is automatically routed to the available tunnel for that specific Site-to-Site VPN connection. However, to protect against a loss of connectivity if your customer gateway becomes unavailable, you can set up a second Site-to-Site VPN connection to your VPC and virtual private gateway by using a second customer gateway. By using redundant Site-to-Site VPN connections and customer gateways, you can perform maintenance on one of your customer gateways while traffic continues to flow over the second customer gateway Site-to-Site VPN connection. +To ensure operational stability in case of failures, Site-to-Site VPN has built in high-availability. AWS Site-to-Site VPN connection has two tunnels, with each tunnel using a unique virtual private gateway public IP address. It is important to configure both tunnels for redundancy, if one tunnel becomes unavailable (for example, if it is down for maintenance), network traffic is automatically routed to the available tunnel for that specific Site-to-Site VPN connection. However, to protect against a loss of connectivity if your customer gateway becomes unavailable, you can set up a second Site-to-Site VPN connection to your VPC and virtual private gateway by using a second customer gateway. By using redundant Site-to-Site VPN connections and customer gateways, you can perform maintenance on one of your customer gateways while traffic continues to flow over the second customer gateway Site-to-Site VPN connection. @@ -64 +64 @@ To ensure operational stability in case of failures, AWS VPN has built in high-a -**AWS Transit Gateway:** Leveraging a transit gateway as a central hub enables access between your VPC resources and on-premises using AWS Direct connect or AWS VPN. AWS Transit Gateway provides statistics and logs that can be used by services such as Amazon CloudWatch and [Amazon VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html). You can start by tracking health data and manage operations by building dashboards/alarms off [transit gateway attachment level CloudWatch metrics](https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-cloudwatch-metrics.html). You can use Amazon CloudWatch to retrieve bandwidth usage between Amazon VPCs and a VPN connection, packet flow count, and packet drop count. Additionally, you can enable Amazon VPC Flow Logs on AWS Transit Gateway to capture information on the IP traffic routed through the AWS Transit Gateway. +**AWS Transit Gateway:** Leveraging a transit gateway as a central hub enables access between your VPC resources and on-premises using AWS Direct connect or Site-to-Site VPN. AWS Transit Gateway provides statistics and logs that can be used by services such as Amazon CloudWatch and [Amazon VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html). You can start by tracking health data and manage operations by building dashboards/alarms off [transit gateway attachment level CloudWatch metrics](https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-cloudwatch-metrics.html). You can use Amazon CloudWatch to retrieve bandwidth usage between Amazon VPCs and a VPN connection, packet flow count, and packet drop count. Additionally, you can enable Amazon VPC Flow Logs on AWS Transit Gateway to capture information on the IP traffic routed through the AWS Transit Gateway. @@ -123 +123 @@ Refer to the following resources to learn more about AWS best practices for oper - * [How do I monitor AWS VPN tunnels using Amazon CloudWatch alarms?](https://aws.amazon.com/premiumsupport/knowledge-center/monitor-vpn-with-cloudwatch-alarms/) + * [How do I monitor Site-to-Site VPN tunnels using Amazon CloudWatch alarms?](https://aws.amazon.com/premiumsupport/knowledge-center/monitor-vpn-with-cloudwatch-alarms/)