AWS res documentation change
Summary
Editorial updates including rephrasing recommendations as best practices, correcting terminology (e.g., 'publish-subscribe' instead of 'publication-subscriber'), fixing typos, and clarifying service names (Elastic Load Balancing instead of ELB). Minor clarifications to security group descriptions and TLS requirements.
Security assessment
The changes are primarily editorial improvements and clarifications. No specific security vulnerabilities, incidents, or weaknesses are mentioned or addressed. The security-related content (security groups, encryption, TLS) remains substantively the same with only minor wording changes for clarity. The change from 'We require TLS 1.2, but recommend TLS 1.3' to 'TLS 1.2 is required, but TLS 1.3 is recommended' is a stylistic change that does not alter the security posture or indicate a new vulnerability.
Diff
diff --git a/res/latest/ug/plan-your-deployment.md b/res/latest/ug/plan-your-deployment.md index da41b99d4..54afa58cb 100644 --- a//res/latest/ug/plan-your-deployment.md +++ b//res/latest/ug/plan-your-deployment.md @@ -19 +19 @@ You are responsible for the cost of the AWS services used while running this pro -We recommend creating a [budget](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-create.html) through [AWS Cost Explorer](https://aws.amazon.com/aws-cost-management/aws-cost-explorer/) to help manage costs. Prices are subject to change. For full details, see the pricing webpage for each AWS service used in this product. +As a best practice, create a [budget](https://docs.aws.amazon.com/cost-management/latest/userguide/budgets-create.html) through [AWS Cost Explorer](https://aws.amazon.com/aws-cost-management/aws-cost-explorer/) to help manage costs. Prices are subject to change. For full details, see the pricing webpage for each AWS service used in this product. @@ -46 +46 @@ Your organization's administrator can manage user access with an active director -The security groups created in this product are designed to control and isolate network traffic between the Lambda functions, EC2 instances, file systems CSR instances, and remote VPN endpoints. We recommend that you review the security groups and further restrict access as needed once the product is deployed. +The security groups created in this product are designed to control and isolate network traffic between the Lambda functions, Amazon EC2 instances, file systems, and remote VPN endpoints. Review the security groups and further restrict access as needed after the product is deployed. @@ -50 +50 @@ The security groups created in this product are designed to control and isolate -By default, Research and Engineering Studio on AWS (RES) encrypts customer data at rest and in transit using an RES owned key. When you deploy RES, you may specify an AWS KMS key. RES uses your credentials to grant key access. If you supply a customer owned and managed AWS KMS key, customer data at rest will be encrypted using that key. +By default, Research and Engineering Studio on AWS (RES) encrypts customer data at rest and in transit using an RES-owned key. When you deploy RES, you may specify an AWS KMS key. RES uses your credentials to grant key access. If you supply a customer owned and managed AWS KMS key, customer data at rest will be encrypted using that key. @@ -52 +52 @@ By default, Research and Engineering Studio on AWS (RES) encrypts customer data -RES encrypts customer data in transit using SSL/TLS. We require TLS 1.2, but recommend TLS 1.3. +RES encrypts customer data in transit using SSL/TLS. TLS 1.2 is required, but TLS 1.3 is recommended. @@ -61 +61 @@ AWS service security info | Service type | How the service is used in RES -[Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/security.html) | Core | Bastion, cluster-manager, and VDI hosts are created in Auto Scaling groups behind the load balancer. ELB balances traffic from the web portal across RES hosts. +[Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/security.html) | Core | Bastion, cluster-manager, and VDI hosts are created in Auto Scaling groups behind the load balancer. Elastic Load Balancing balances traffic from the web portal across RES hosts. @@ -76 +76 @@ AWS service security info | Service type | How the service is used in RES -[Amazon Simple Notification Service](https://docs.aws.amazon.com/sns/latest/dg/sns-security.html) | Supporting | Supports the publication-subscriber model between VDI components such as the controller and hosts. +[Amazon Simple Notification Service](https://docs.aws.amazon.com/sns/latest/dg/sns-security.html) | Supporting | Supports the publish-subscribe model between VDI components such as the controller and hosts. @@ -91 +91 @@ Make sure you have sufficient quota for each of the [ services implemented in th -For this product, we recommend raising quotas for the following services: +As a best practice, raise quotas for the following services: @@ -104 +104 @@ To request a quota increase, see [Requesting a Quota Increase](https://docs.aws. -Your AWS account has AWS CloudFormation quotas that you should be aware of when [launching the stack](./launch-the-product.html) in this product. By understanding these quotas, you can avoid limitation errors that would prevent you from deploying this product successfully. For more information, see [AWS CloudFormation quotas](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cloudformation-limits.html) in the in the _AWS CloudFormation User’s Guide_. +Your AWS account has AWS CloudFormation quotas that you should be aware of when [launching the stack](./launch-the-product.html) in this product. By understanding these quotas, you can avoid limitation errors that would prevent you from deploying this product successfully. For more information, see [AWS CloudFormation quotas](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cloudformation-limits.html) in the _AWS CloudFormation User Guide_. @@ -108 +108 @@ Your AWS account has AWS CloudFormation quotas that you should be aware of when -The product deploys a default infrastructure with the minimum number and size of Amazon EC2 instances to operate the system. To improve resilience in large-scale production environments, we recommend increasing the default minimum capacity settings within the infrastructure's Auto Scaling groups (ASG). Increasing the value from one instance to two instances provides the benefit of multiple Availability Zones (AZ) and reduces the time to restore system functionality in the event of unexpected data loss. +The product deploys a default infrastructure with the minimum number and size of Amazon EC2 instances to operate the system. To improve resilience in large-scale production environments, as a best practice, increase the default minimum capacity settings within the infrastructure's Auto Scaling groups (ASG). Increasing the value from one instance to two instances provides the benefit of multiple Availability Zones (AZ) and reduces the time to restore system functionality in the event of unexpected data loss.