AWS r53recovery documentation change
Summary
Updated terminology and structure for Region switch plans: changed 'nested plans' to 'parent plans', clarified step/execution block hierarchy, moved cross-account configuration from execution blocks to steps, added API reference link, and strengthened CloudWatch alarm requirements.
Security assessment
The changes are documentation improvements for clarity and accuracy without addressing specific vulnerabilities. The cross-account IAM guidance references existing security documentation but doesn't introduce new security content. No evidence of patching vulnerabilities or incident response.
Diff
diff --git a/r53recovery/latest/dg/region-switch-plans.md b/r53recovery/latest/dg/region-switch-plans.md index dab7e60a3..fe4eaa896 100644 --- a//r53recovery/latest/dg/region-switch-plans.md +++ b//r53recovery/latest/dg/region-switch-plans.md @@ -11 +11 @@ With Region switch, you can orchestrate the specific steps to switch the AWS Reg -Region switch is built around the concept of a _plan_ , which you design and configure for your specific recovery needs. Each plan includes _workflows_ that are made up of steps. A step runs one or more _execution blocks_ , which Region switch runs in parallel or in sequence, to complete an application recovery. Each execution block handles a different task, such as switching over resources or managing traffic redirection for your application. For even more flexibility, you can create nested plans, by adding child plans. +Region switch is built around the concept of a _plan_ , which you design and configure for your specific recovery needs. Each plan includes _workflows_ that are made up of steps. Each step runs one or more _execution blocks_ , which Region switch runs in parallel or in sequence, to complete an application recovery. Each execution block handles a different task, such as switching over resources or managing traffic redirection for your application. For even more flexibility, you can create parent plans, by adding child plans. @@ -39 +39 @@ You can create multiple plans, one for each of your multi-Region applications, a -After you create a Region switch plan, you must add one or more workflows to the plan, to define the steps you want the plan to perform for your application recovery. For each workflow, you add execution blocks to complete specific tasks, like scaling up resources or updating routing controls to reroute traffic. Execution blocks enable you to specify these tasks and the order in which they're completed. By creating nested plans, you can also orchestrate the order in which multiple applications recover into the Region that you're activating. +After you create a Region switch plan, you must add one or more workflows to the plan, to define the steps you want the plan to perform for your application recovery. For each workflow, you add steps that contain execution blocks. Each execution block performs a specific recovery action, such as scaling up resources or updating routing controls to reroute traffic. Steps organize these execution blocks and control whether they run in parallel or in sequence. By creating parent plans, you can also orchestrate the order in which multiple applications recover into the Region that you're activating. @@ -41 +41 @@ After you create a Region switch plan, you must add one or more workflows to the -You can add execution blocks in a workflow sequentially, or you can add one or more execution blocks in parallel. Also, depending on the resource, you can have the option to run an execution block with graceful (planned) or ungraceful (unplanned) execution. +You organize execution blocks into steps within a workflow. Each step can contain one or more execution blocks that run in parallel, and you arrange steps to run sequentially in your workflow. Also, depending on the resource, you can have the option to run an execution block with graceful (planned) or ungraceful (unplanned) execution. @@ -50 +50 @@ You can add execution blocks in a workflow sequentially, or you can add one or m -Finally, you can also configure cross-account resources for an execution block. First, you must configure permissions, by following the guidance in [Cross-account support in Region switch](./cross-account-resources-rs.html). After you've set up the required IAM roles, then you can add cross-acount resources in the execution blocks in your plan workflows. To add cross-account resources, when you add an execution block, you specify a target IAM role that has permissions to the resource of other AWS accounts. You also must specify the external ID that you provided in the trust policy for the cross-account role. For details about creating the required IAM roles, see [Cross-account resource permissions](./security_iam_region_switch_cross_account.html). +Finally, you can also configure cross-account resources for an execution block. First, you must configure permissions, by following the guidance in [Cross-account support in Region switch](./cross-account-resources-rs.html). After you've set up the required IAM roles, then you can add cross-acount resources in the execution blocks in your plan workflows. To add cross-account resources, when you add a step, you specify a target IAM role that has permissions to the resource of other AWS accounts. You also must specify the external ID that you provided in the trust policy for the cross-account role. For details about creating the required IAM roles, see [Cross-account resource permissions](./security_iam_region_switch_cross_account.html). @@ -58 +58 @@ Plan evaluation is an automated process that Region switch runs when a plan is c -If Region switch finds an issue that might prevent a successful plan execution, it generates a plan evaluation warning, which is highlighted on the plan details page in the console. You can also consume plan evaluation warnings with Amazon EventBridge, or you can view warnings by using the Region switch API. +If Region switch finds an issue that might prevent a successful plan execution, it generates a plan evaluation warning, which is highlighted on the plan details page in the console. You can also consume plan evaluation warnings with Amazon EventBridge, or you can view warnings by using the Region switch API. For more information about the Plan Evaluation API, see [GetPlanEvaluationStatus](https://docs.aws.amazon.com/arc-region-switch/latest/api/API_GetPlanEvaluationStatus.html) in the _Region Switch API Reference Guide_ for Amazon Application Recovery Controller (ARC). @@ -99 +99 @@ Actual recovery time is calculated as the total of the time is takes for a plan -To support calculating an accurate actual recovery time for plan execution, add Regional Amazon CloudWatch alarms to a Region switch plan that provide a signal about the health of your application in each Region. When a plan is executed, Region switch uses these application health alarms to determine when your application is healthy again. Then, Region switch calculates actual recovery time based on the time it takes for your plan to execute added to the time it takes for your application to return to healthy, based on the application health alarms that you specify. +To support calculating an accurate actual recovery time for plan execution, you must configure Regional Amazon CloudWatch alarms for a Region switch plan that provide a signal about the health of your application in each Region. When a plan is executed, Region switch uses these application health alarms to determine when your application is healthy again. Then, Region switch calculates actual recovery time based on the time it takes for your plan to execute added to the time it takes for your application to return to healthy, based on the application health alarms that you configure.