AWS aws-backup documentation change
Summary
Updated gateway creation documentation to include IPv6 support, clarified methods, and added critical note about IPv6 hypervisor requirements
Security assessment
Changes focus on IPv6 functionality and configuration requirements. While misconfiguration warnings are present, there's no evidence of patched vulnerabilities or security incidents. The IPv6 firewall reference is for functional configuration, not security features.
Diff
diff --git a/aws-backup/latest/devguide/working-with-gateways.md b/aws-backup/latest/devguide/working-with-gateways.md index 535b775e9..ed0b41117 100644 --- a//aws-backup/latest/devguide/working-with-gateways.md +++ b//aws-backup/latest/devguide/working-with-gateways.md @@ -17 +17 @@ You can create a backup gateway using two approaches: - * **Console method (standard)** : Creates IPv4-only gateways through the AWS Backup console with automatic activation + * **Console method (standard)** : Creates gateways through the AWS Backup console with automatic activation @@ -19 +19 @@ You can create a backup gateway using two approaches: - * **Manual method** : Supports both IPv4 and IPv6 by obtaining activation keys and using AWS CLI commands + * **Manual method** : Creates gateways using gateway VM's local console by obtaining activation keys and using AWS CLI commands @@ -26 +26 @@ Both methods require downloading and deploying the OVF template first (see [Down -### Console method (IPv4 only) +Both methods allow gateway to communicate over IPv6, which requires gateway appliance version 2.x+ and additional firewall configuration on [dual-stack endpoints](https://docs.aws.amazon.com/aws-backup/latest/devguide/configure-infrastructure-bgw.html#bgw-firewall-configuration). @@ -28 +28,5 @@ Both methods require downloading and deploying the OVF template first (see [Down -Use this method for standard IPv4 gateway creation through the AWS Backup console with automatic activation. +###### Important + +**IPv6 hypervisor requirement:** If your gateway is activated through IPv6, you **must** create a hypervisor with an IPv6 address. For example, use `2607:fda8:1001:210::252` instead of `10.0.0.252`. If you associate an IPv6 gateway with an IPv4 hypervisor, backup and restore jobs will likely fail. + +### Console method @@ -102 +106 @@ Once the VMWare software is downloaded, complete the following steps: - 4. Depending on the endpoint chosen, enter the VPC endpoint DNS Name. + * If **publicly accessible** is selected, choose the IP version (IPv4 or IPv6) for gateway connectivity. @@ -104 +108 @@ Once the VMWare software is downloaded, complete the following steps: -For more information, see [Create a VPC endpoint](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-network.html#backup-privatelink). + * If **VPC** is selected, enter the VPC endpoint DNS Name. For more information, see [Create a VPC endpoint](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-network.html#backup-privatelink). @@ -113,7 +117 @@ For more information, see [Create a VPC endpoint](https://docs.aws.amazon.com/aw -### Manual gateway creation (IPv4 and IPv6) - -For IPv6 support, create gateways manually using activation keys. IPv6 support requires gateway appliance version 2.x+ and additional firewall configuration on [dual-stack endpoints](https://docs.aws.amazon.com/aws-backup/latest/devguide/configure-infrastructure-bgw.html#bgw-firewall-configuration). - -###### Important - -**IPv6 hypervisor requirement:** If your gateway is activated through IPv6, you **must** create a hypervisor with an IPv6 address. For example, use `2607:fda8:1001:210::252` instead of `10.0.0.252`. If you associate an IPv6 gateway with an IPv4 hypervisor, backup and restore jobs will likely fail. +### Manual gateway creation