AWS transform documentation change
Summary
Added 'Source Network Convergence' section detailing VPC creation from source network segments, restructured network topology documentation with explicit security notes about internet access requirements, and added Landing Zone Accelerator integration details
Security assessment
The changes emphasize that internet communication is not automatically opened (requiring manual configuration after security precautions) and highlight security group enforcement. While these are security-conscious practices, there's no evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/transform/latest/userguide/transform-vmware-migrate-network.md b/transform/latest/userguide/transform-vmware-migrate-network.md index 9fad61f06..8bfe4a4c8 100644 --- a//transform/latest/userguide/transform-vmware-migrate-network.md +++ b//transform/latest/userguide/transform-vmware-migrate-network.md @@ -5 +5 @@ -Network configuration generatorsNetwork topologiesIP migration approachesGenerate VPC configurationTag network resourcesSecurity group association +Source Network ConvergenceNetwork TopologiesNetwork configuration generatorsIP migration approachesGenerate VPC configurationTag network resourcesSecurity group association @@ -37,0 +38,44 @@ Once the target network is generated, review the generated network configuration +## Source Network Convergence + +During end-to-end migration or network-only migration jobs, AWS Transform creates AWS Virtual Private Clouds (VPCs) from all source network segments in the **Generate VPC Configuration** stage. Each detected network segment becomes its own distinct VPC. + +Network segmentation by source type: + + * For vNetwork: AWS Transform groups VMs by vSwitch and VLAN, with VLAN presented under multiple vSwitches (except for VLAN 0). + + * For NSX networks: AWS Transform segments the network based on Tier-1 routers by grouping the routers and collecting the segments. + + + + +## Network Topologies + +During the migration to the target network you can choose the Isolated VPCs topology or the Hub and Spoke topology. + +###### Important + +For both topologies, AWS Transform does not open the communication to the internet. You must open it manually after taking appropriate security precautions. + +### Isolated VPCs + +These are independent network environments that operate as separate units within AWS . VPCs maintain complete network isolation, with no built-in communication pathways between them. This separation provides the highest level of network boundary protection. You can connect the VPCs through specific networking configurations if needed. + +### Hub and Spoke + +In this model, an AWS Transit Gateway created by AWS Transform acts as the hub that connects to multiple workload VPCs (the spokes). During network convergence, AWS Transform creates a spoke VPC for each detected source network segment. + +AWS Transform creates three specialized VPCs for traffic management and security: + + * Inspection VPC: Where you establish the firewall that inspects the traffic. You can create firewall rule configurations here to modify VPC connections. + + * Inbound VPC: For all traffic from the public internet (north-south). Includes an internet gateway. + + * Outbound VPC: For all traffic to the public internet. Has an internet gateway, a Network Address Translation (NAT) gateway and an [elastic IP address](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html). + + + + +AWS Transform automatically associates all spoke VPCs with the default association route table and propagates routes from all spoke VPCs to the default propagation route table. This automation creates routing paths without manual configuration, though traffic flow remains subject to security group permissions. + +If you want fine-grained control over the communication between the VPCs, choose the **Isolated VPCs** option and modify the generated network to create the specific communication paths your require. + @@ -40 +84 @@ Once the target network is generated, review the generated network configuration -AWS Transform provides multiple generators for creating network infrastructure code from your migrated network configuration. These are available to you in the **Migrate Network** task, after you **Generate VPC configuration** and **Review generated VPC configuration**. When you choose the **Deploy on my own** option AWS Transform for VMware gives you the option to generate Infrastructure-as-Code (IaC) templates in three formats: +AWS Transform provides multiple generators for creating network infrastructure code from your migrated network configuration. These are available to you in the **Migrate Network** task, after you **Generate VPC configuration** and **Review generated VPC configuration**. When you choose the **Deploy on my own** option AWS Transform for VMware gives you the option to generate Infrastructure-as-Code (IaC) templates in four formats: @@ -42 +86 @@ AWS Transform provides multiple generators for creating network infrastructure c - * **CloudFormation** templates + * **CloudFormation** templates that you can use to provision your network resources. @@ -47,0 +92,6 @@ AWS Transform provides multiple generators for creating network infrastructure c + * **Landing Zone Accelerator by AWS** \- A `network-config.yaml` file that works with LZA network configuration. Learn more about the Landing Zone Accelerator solution and how to deploy the network configuration YAML in [Using configuration files](https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/using-configuration-files.html) in the _Landing Zone Accelerator on AWS Implementation Guide_. + +###### Note + +When deploying this network configuration via the Landing Zone Accelerator (LZA) pipeline, ensure that your AWS Transform account and LZA installation are in the same AWS Organization. Deployment will fail if there is a mismatch between the Organizations IDs used in AWS Transform and LZA. To learn how to set up your LZA installation using Organizations see [AWS Organizations based installation (without AWS Control Tower)](https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/prerequisites.html#for-aws-organizations-based-installation-without-aws-control-tower). + @@ -61,8 +111 @@ The network configuration generators generate these key components: - * **Transit Gateway Hub:** Central routing point connecting all VPC segments - - * **Multiple VPC Spokes:** Network segments for different workload types - - * **Centralized Traffic Control:** Inspection, outbound, and inbound VPCs for traffic filtering - - - +For details see Hub and spoke in the Network topologies section. @@ -100,21 +142,0 @@ The generated configuration includes a modular structure for maintainability and -## Network topologies - -During the migration, you can choose one of two network topologies for the target network: - - * **Isolated VPCs** — Each VPC serves as its own unit with no intercommunication among VPCs. - - * **Hub and Spoke** — AWS Transform creates a transit gateway and connects all VPCs using route tables. It also creates 3 additional VPCs: - - * **Inspection VPC** — A placeholder for the firewall to inspect the traffic. - - * **Inbound VPC** — For all traffic from the public internet (North-South). It has an internet gateway. - - * **Outbound VPC** — For all traffic to the public internet. It has a NAT gateway and an elastic IP. - - - - -By default AWS Transform doesn’t open the communication to the internet for either topology. Once you are ready to use your new network and have configured security precautions according to your company policies, you can manually open the network to the internet - -If you want fine-grained control over the communication between the VPCs, choose the **Isolated VPCs** option and modify the generated network to create the specific communication paths your require. -