AWS solutions documentation change
Summary
Updated resource counts and configurations: Increased Lambda functions from 13 to 21 (added Asset Watcher, System Bootstrap, CloudFront Key Generator, Metrics Reporting functions), increased buckets from 5 to 6 (added Portal Bucket), increased VPC endpoints from 8 to 18 (added API Gateway, Athena, CloudFormation, CloudTrail, Deadline, Glue, KMS, SSM, STS, Verified Permissions, Places endpoints). Updated naming patterns and purposes for several resources.
Security assessment
Added documentation for CloudFront Key Generator Function which enables secure URL access, and multiple new VPC endpoints (including KMS and STS) that enhance private connectivity. However, no evidence exists that these changes address specific vulnerabilities or incidents.
Diff
diff --git a/solutions/latest/spatial-data-management-on-aws/aws-resources.md b/solutions/latest/spatial-data-management-on-aws/aws-resources.md index ec84e360f..b2c728a3e 100644 --- a//solutions/latest/spatial-data-management-on-aws/aws-resources.md +++ b//solutions/latest/spatial-data-management-on-aws/aws-resources.md @@ -15 +15 @@ This document provides a comprehensive inventory of all AWS resources deployed b -**Total Functions Deployed:** 13 +**Total Functions Deployed:** 21 @@ -25 +25,3 @@ Assets Search Indexer Function | Indexes asset metadata into OpenSearch for ful -Metrics Emission Function | Emits custom CloudWatch metrics for application monitoring | 900s | 256 MB | Default | Private subnets +Asset Watcher Function | Processes S3 notifications for file uploads/changes, EventBridge for asset operations, and Dymano DB streams for connector invocation updates | 900s | 1024 MB | Reserved: 100 | Private subnets +Metric Emitter Function | Emits custom CloudWatch metrics for application monitoring | 900s | 256 MB | Default | Private subnets +System Bootstrap Function | Initializes system during deployment, creates default library, sets up OpenSearch indexes, and configures initial system state | 900s | 1024 MB | Default | Private subnets @@ -33 +35,2 @@ Portal Runtime Config Lambda | Portal runtime configuration and initialization -Custom Resource Handlers | CloudFormation custom resource handlers for infrastructure setup | 120s | 128 MB +CloudFront Key Generator Function | Generates CloudFront signing key pairs for secure asset URL access | 120s | 128 MB +Metrics Reporting Function | Collects and sends anonymous usage metrics for solution analytics | 900s | 256 MB @@ -38,0 +42,2 @@ Asset Preview Distribution | Handles asset preview and distribution logic | 90 +There are also 6 additional lambdas that get created for managing custom resource lambdas, assisting deployment, and orchestrating CloudFormation custom resource operations (these are automatically generated by AWS CDK). + @@ -87 +92 @@ Resource Associations Table | SourceResourceId (String) | TargetResourceId (St -**Total Buckets Deployed:** 5 +**Total Buckets Deployed:** 6 @@ -91,5 +96,6 @@ Bucket Name | Purpose | Naming Pattern | Versioning | Encryption | Lifecycle | P -Asset Storage Bucket | Primary storage for spatial asset files (E57, LAS, point clouds, 3D models, images). Stores asset and file metadata, and maintains file and folder hierarchy information. | `spatial-data-management-asset-<deployment-uuid>` | Enabled | SSE-S3 | Configurable (default: none) | Blocked -Asset Log Bucket | S3 access logs for asset bucket | `spatial-data-management-asset-log-<deployment-uuid>` | Enabled | SSE-S3 | 90-day expiration | Blocked -Portal CloudFront Log Bucket | CloudFront access logs for web portal distribution | `spatial-data-management-portal-log-<deployment-uuid>` | Enabled | SSE-S3 | 90-day expiration | Blocked -Telemetry Bucket | Application telemetry, usage analytics, and custom metrics | `spatial-data-management-telemetry-<deployment-uuid>` | Enabled | SSE-S3 | Configurable | Blocked -CloudTrail Bucket | AWS API audit logs from CloudTrail | `spatial-data-management-cloudtrail-<deployment-uuid>` | Enabled | SSE-S3 | 90-day retention | Blocked +Asset Storage Bucket | Primary storage for spatial asset files (E57, LAS, point clouds, 3D models, images). Stores asset and file metadata, and maintains file and folder hierarchy information. | `spatial-data-management-assets-<account-id>-<region>` | Enabled | SSE-S3 | Configurable (default: none) | Blocked +Asset Log Bucket | S3 access logs for asset bucket | `spatial-data-management-assets-<account-id>-<region>-logs` | Enabled | SSE-S3 | 90-day expiration | Blocked +Portal Bucket | Static web assets for the React portal application | `spatialdatamanagement…-portalcloudfrontdist…-<uuid>` | Enabled | SSE-S3 | None | Blocked (CloudFront access only) +Portal CloudFront Log Bucket | CloudFront access logs for web portal distribution | `spatialdatamanagement…-portalcloudfront…-<uuid>` | Enabled | SSE-S3 | 90-day expiration | Blocked +Telemetry Bucket | Application telemetry, usage analytics, and custom metrics | `spatialdatamanagement…-telemetry…-<uuid>` | Enabled | SSE-S3 | Configurable | Blocked +CloudTrail Bucket | AWS API audit logs from CloudTrail | `spatialdatamanagement…-cloudtrailbucket…-<uuid>` | Enabled | SSE-S3 | 90-day retention | Blocked @@ -124 +130 @@ Dead Letter Queues (4 instances) | Standard | Captures failed messages after m -**Total Endpoints Deployed:** 8 +**Total Endpoints Deployed:** 18 @@ -128 +133,0 @@ Endpoint Name | Type | Service | Purpose | Subnets | Security Group | DNS -OpenSearch Serverless VPC Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.aoss` | Secure private access to OpenSearch Serverless from VPC | Private (both AZs) | Allows HTTPS (443) from Lambda | Private DNS enabled @@ -130,0 +136 @@ S3 Gateway Endpoint | Gateway | `com.amazonaws.<region>.s3` | Private access +OpenSearch Serverless VPC Endpoint | Interface (PrivateLink) | `com.amazonaws.vpce.<region>.vpce-svc-<uuid>` | Secure private access to OpenSearch Serverless from VPC | Private (both AZs) | Allows HTTPS (443) from Lambda | Private DNS enabled @@ -135 +141,11 @@ SQS Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.sqs -EC2 Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.ec2` | Private EC2 API access (for ENI management) | Private | Allows HTTPS from VPC | Private DNS enabled +API Gateway Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.execute-api` | Private API Gateway access | Private | Allows HTTPS from Lambda | Private DNS enabled +Athena Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.athena` | Private Athena access | Private | Allows HTTPS from Lambda | Private DNS enabled +CloudFormation Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.cloudformation` | Private CloudFormation access | Private | Allows HTTPS from Lambda | Private DNS enabled +CloudTrail Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.cloudtrail` | Private CloudTrail access | Private | Allows HTTPS from Lambda | Private DNS enabled +Deadline Cloud Management Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.deadline.management` | Private Deadline Cloud Management access | Private | Allows HTTPS from Lambda | Private DNS enabled +Glue Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.glue` | Private Glue access | Private | Allows HTTPS from Lambda | Private DNS enabled +KMS Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.kms` | Private KMS access | Private | Allows HTTPS from Lambda | Private DNS enabled +SSM Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.ssm` | Private SSM access | Private | Allows HTTPS from Lambda | Private DNS enabled +STS Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.sts` | Private STS access | Private | Allows HTTPS from Lambda | Private DNS enabled +Verified Permissions Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.verifiedpermissions` | Private Verified Permissions access | Private | Allows HTTPS from Lambda | Private DNS enabled +Places Interface Endpoint | Interface (PrivateLink) | `com.amazonaws.<region>.geo.places` | Private Places access | Private | Allows HTTPS from Lambda | Private DNS enabled @@ -225 +240,0 @@ Default VPC Security Group | Default VPC security group | All from self | All - ├── SNS Topics (3) @@ -279 +294 @@ Default VPC Security Group | Default VPC security group | All from self | All - * VPC Infrastructure (1 VPC, 6 subnets across 2 AZs, 8 VPC endpoints, 4 security groups) + * VPC Infrastructure (1 VPC, 6 subnets across 2 AZs, 18 VPC endpoints, 4 security groups) @@ -289,2 +303,0 @@ Default VPC Security Group | Default VPC security group | All from self | All - * SNS Topics (3 total) -