AWS r53recovery documentation change
Summary
Restructured the tutorial steps by adding section headers for each execution block (EC2 Auto Scaling, manual approval, Lambda maintenance page, Aurora Global Database, ARC routing control) and renumbered substeps. Added links to block-specific documentation and removed the fencing Lambda execution block.
Security assessment
The changes reorganize documentation steps and add reference links but contain no evidence of addressing security vulnerabilities. The removed fencing mechanism could potentially impact failover security, but the diff provides no context or justification for its removal. The manual approval block addition improves change control but is a standard operational practice.
Diff
diff --git a/r53recovery/latest/dg/tutorial-region-switch.md b/r53recovery/latest/dg/tutorial-region-switch.md index bfbebc5ad..762a55ac4 100644 --- a//r53recovery/latest/dg/tutorial-region-switch.md +++ b//r53recovery/latest/dg/tutorial-region-switch.md @@ -139 +138,0 @@ Before executing the plan, Region switch will verify the following: - 5. Choose **Add a step** , and then select **Run in sequence**. @@ -141 +139,0 @@ Before executing the plan, Region switch will verify the following: - 6. Select the **EC2 Auto Scaling execution block** , and then choose **Add and edit**. This block will allow you to start increasing capacity in the passive Region. @@ -143 +141,10 @@ Before executing the plan, Region switch will verify the following: - 7. In the right panel, configure the block: + +### Add EC2 Auto Scaling execution block + +For more information about this execution block, see [Amazon EC2 Auto Scaling group execution block](./ec2-auto-scaling-block.html). + + 1. Choose **Add a step** , and then select **Run in sequence**. + + 2. Select the **EC2 Auto Scaling execution block** , and then choose **Add and edit**. This block will allow you to start increasing capacity in the passive Region. + + 3. In the right panel, configure the block: @@ -161 +168,2 @@ For information about the required IAM permissions for this execution block, see - 8. Choose **Save step**. + 4. Choose **Save step**. + @@ -163 +170,0 @@ For information about the required IAM permissions for this execution block, see - 9. Choose **Add a step**. @@ -165 +171,0 @@ For information about the required IAM permissions for this execution block, see - 10. Select the **Manual approval execution block** and add it to the design window. This block allows for human verification before proceeding. @@ -167 +173,9 @@ For information about the required IAM permissions for this execution block, see - 11. In the right panel, configure the block: +### Add manual approval execution block + +For more information about this execution block, see [Manual approval execution block](./manual-approval-block.html). + + 1. Choose **Add a step**. + + 2. Select the **Manual approval execution block** and add it to the design window. This block allows for human verification before proceeding. + + 3. In the right panel, configure the block: @@ -179 +193 @@ For information about the required IAM permissions for this execution block, see - 12. Choose **Save step**. + 4. Choose **Save step**. @@ -181 +194,0 @@ For information about the required IAM permissions for this execution block, see - 13. Choose **Add a step**. @@ -183 +195,0 @@ For information about the required IAM permissions for this execution block, see - 14. Select the **Custom action Lambda execution block** , and then choose **Add and edit**. This block publishes a maintenance page in the Region that is activating. @@ -185 +196,0 @@ For information about the required IAM permissions for this execution block, see - 15. In the right panel, configure the block: @@ -187 +198 @@ For information about the required IAM permissions for this execution block, see - * **Step name** : Enter "Display maintenance page" +### Add custom action Lambda execution block for maintenance page @@ -189,5 +200 @@ For information about the required IAM permissions for this execution block, see - * **Step description** (optional) - - * **Lambda ARN for activating us-east-1** : The ARN of the maintenance page Lambda function deployed in us-east-1 - - * **Lambda ARN for activating us-west-2** : The ARN of the maintenance page Lambda function deployed in us-west-2 +For more information about this execution block, see [Custom action Lambda execution block](./custom-action-lambda-block.html). @@ -195 +202 @@ For information about the required IAM permissions for this execution block, see - * **Region to run the Lambda function** : Choose **Run in activating Region** + 1. Choose **Add a step**. @@ -197 +204 @@ For information about the required IAM permissions for this execution block, see - * **Timeout** (optional) + 2. Select the **Custom action Lambda execution block** , and then choose **Add and edit**. This block publishes a maintenance page in the Region that is activating. @@ -199,3 +206 @@ For information about the required IAM permissions for this execution block, see - * **Retry interval** (optional) - -For information about the required IAM permissions for this execution block, see [Custom action Lambda execution block sample policy](./security_iam_region_switch_lambda.html). + 3. In the right panel, configure the block: @@ -203,9 +208 @@ For information about the required IAM permissions for this execution block, see - 16. Choose **Save step**. - - 17. Choose **Add a step**. - - 18. Select a second **Custom action Lambda execution block** , and then choose **Add and edit**. This block triggers a fencing mechanism in the active Region that ensures that the deactivating Region can no longer accept traffic. - - 19. In the right panel, configure the block: - - * **Step name** : Enter "Fencing" + * **Step name** : Enter "Display maintenance page" @@ -215 +212 @@ For information about the required IAM permissions for this execution block, see - * **Lambda ARN for activating us-east-1** : The ARN of the fencing Lambda function deployed in us-east-1 + * **Lambda ARN for activating us-east-1** : The ARN of the maintenance page Lambda function deployed in us-east-1 @@ -217 +214 @@ For information about the required IAM permissions for this execution block, see - * **Lambda ARN for activating us-west-2** : The ARN of the fencing Lambda function deployed in us-west-2 + * **Lambda ARN for activating us-west-2** : The ARN of the maintenance page Lambda function deployed in us-west-2 @@ -219 +216 @@ For information about the required IAM permissions for this execution block, see - * **Region to run Lambda function** : Choose **Run in deactivating Region** + * **Region to run the Lambda function** : Choose **Run in activating Region** @@ -227,5 +224 @@ For information about the required IAM permissions for this execution block, see - 20. Choose **Save step**. - - 21. Choose **Add a step**. - - 22. Select **Manual approval execution block** , and then choose **Add and edit**. This block requests approval from a team member. + 4. Choose **Save step**. @@ -233 +225,0 @@ For information about the required IAM permissions for this execution block, see - 23. In the right panel, configure the block: @@ -235 +226,0 @@ For information about the required IAM permissions for this execution block, see - * **Step name** : Enter **Manual approval before Database and DNS change** @@ -237,3 +227,0 @@ For information about the required IAM permissions for this execution block, see - * **Step description** (optional) - - * **IAM approval role** : The role a user must assume so that they can approve the execution @@ -241,3 +229 @@ For information about the required IAM permissions for this execution block, see - * **Timeout** (optional) - -For information about the required IAM permissions for this execution block, see [Manual approval execution block sample policy](./security_iam_region_switch_manual_approval.html). +### Add Aurora Global Database execution block @@ -245 +231 @@ For information about the required IAM permissions for this execution block, see - 24. Choose **Save step**. +For more information about this execution block, see [Amazon Aurora Global Database execution block](./aurora-global-database-block.html). @@ -247 +233 @@ For information about the required IAM permissions for this execution block, see - 25. Choose **Add a step**. + 1. Choose **Add a step**. @@ -249 +235 @@ For information about the required IAM permissions for this execution block, see - 26. Select the **Aurora Global Database execution block** , and then choose **Add and edit**. This block triggers an Aurora global database switchover (no data loss). For more information, see [Using switchover or failover for Aurora Global Database](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-disaster-recovery.html) in the _Aurora User Guide_. + 2. Select the **Aurora Global Database execution block** , and then choose **Add and edit**. This block triggers an Aurora global database switchover (no data loss). For more information, see [Using switchover or failover for Aurora Global Database](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database-disaster-recovery.html) in the _Aurora User Guide_. @@ -251 +237 @@ For information about the required IAM permissions for this execution block, see - 27. In the right panel, configure the block: + 3. In the right panel, configure the block: @@ -269 +255,8 @@ For information about the required IAM permissions for this execution block, see - 28. Choose **Save step**. + 4. Choose **Save step**. + + + + +### Add ARC routing control execution block + +For more information about this execution block, see [ARC routing control execution block](./arc-routing-controls-block.html). @@ -271 +264 @@ For information about the required IAM permissions for this execution block, see - 29. Choose **Add a step**. + 1. Choose **Add a step**. @@ -273 +266 @@ For information about the required IAM permissions for this execution block, see - 30. Select **ARC routing control execution block** , and then choose **Add and edit**. This block performs a DNS failover to shift traffic to the passive Region. + 2. Select **ARC routing control execution block** , and then choose **Add and edit**. This block performs a DNS failover to shift traffic to the passive Region. @@ -275 +268 @@ For information about the required IAM permissions for this execution block, see - 31. In the right panel, configure the block: + 3. In the right panel, configure the block: @@ -285 +278 @@ For information about the required IAM permissions for this execution block, see - 32. Choose **Add routing control** : + 4. Choose **Add routing control** : @@ -291 +284 @@ For information about the required IAM permissions for this execution block, see - 33. Choose **Add routing control** again: + 5. Choose **Add routing control** again: @@ -297 +290 @@ For information about the required IAM permissions for this execution block, see - 34. Choose **Save**. + 6. Choose **Save**. @@ -299 +292 @@ For information about the required IAM permissions for this execution block, see - 35. **Routing controls used in activating us-west-2** : Choose **Add routing controls** + 7. **Routing controls used in activating us-west-2** : Choose **Add routing controls** @@ -301 +294 @@ For information about the required IAM permissions for this execution block, see - 36. Choose **Add routing control** : + 8. Choose **Add routing control** : @@ -307 +300 @@ For information about the required IAM permissions for this execution block, see - 37. Choose **Add routing control** again: + 9. Choose **Add routing control** again: @@ -313 +306 @@ For information about the required IAM permissions for this execution block, see - 38. Choose **Save**. + 10. Choose **Save**. @@ -315 +308 @@ For information about the required IAM permissions for this execution block, see - 39. Choose **Save step**. + 11. Choose **Save step**. @@ -319 +312 @@ For information about the required IAM permissions for this execution block, see - 40. Choose **Save**. + 12. Choose **Save**.