AWS guidance documentation change
Summary
Updated deployment documentation for Connected Mobility Solution with clarifications about simulation infrastructure (adding EC2 for FleetWise Edge), new demo data seeding commands, IAM role updates for VPC Destination, and infrastructure type clarifications
Security assessment
This change adds and updates deployment documentation with several security-relevant updates: 1) IAM role for VPC Destination now includes Secrets Manager access for retrieving MSK SCRAM credentials (security feature for authentication), 2) Clarifies infrastructure security boundaries (Fargate vs EC2 deployment models), 3) Adds documentation about secure credential retrieval mechanisms. These are security feature additions and best practice documentation updates rather than fixes for specific security issues.
Diff
diff --git a/guidance/latest/connected-mobility-on-aws/deploy-the-solution.md b/guidance/latest/connected-mobility-on-aws/deploy-the-solution.md index 8c657ef6c..8e4f472d3 100644 --- a//guidance/latest/connected-mobility-on-aws/deploy-the-solution.md +++ b//guidance/latest/connected-mobility-on-aws/deploy-the-solution.md @@ -33 +33 @@ The guidance deploys in multiple phases with clear dependencies between stacks. - * Simulation: ECS Fargate Cloud Simulation (3-5 minutes) + * Simulation: ECS Cloud Simulation — Fargate for MQTT Direct, EC2 for FleetWise Edge (3-5 minutes) @@ -244,0 +245,2 @@ Deploy individual phases for more control: + make seed-all-demo-data # Runs all seeders (drivers, vehicles, trips, service, warranty, recalls) + make upload-decoder-manifest # Uploads DecoderManifest.bin to Flink S3 bucket @@ -249 +251 @@ Deploy individual phases for more control: - # Cloud Simulation — ECS Fargate cluster + Lambda orchestrator (3-5 minutes) + # Cloud Simulation — ECS cluster (Fargate + EC2) + Lambda orchestrator (3-5 minutes) @@ -373,0 +376,2 @@ Phases must be deployed in order due to dependencies. `phase3b` depends on `phas + * IAM role for VPC Destination includes Secrets Manager access (to retrieve MSK SCRAM credentials) + @@ -446,0 +451,2 @@ Phases must be deployed in order due to dependencies. `phase3b` depends on `phas + * DecoderManifest.bin uploaded to S3 — the Flink CampaignSyncProcessor reads the protobuf decoder manifest from `s3://{flink-jar-bucket}/fwe-config/DecoderManifest.bin` and delivers it to FWE agents on checkin + @@ -475 +481 @@ Phases must be deployed in order due to dependencies. `phase3b` depends on `phas - * `cms-{stage}-simulation` — ECS Fargate simulation infrastructure + * `cms-{stage}-simulation` — ECS simulation infrastructure (Fargate + EC2-backed) @@ -484 +490 @@ Phases must be deployed in order due to dependencies. `phase3b` depends on `phas - * Fargate task definitions (MQTT Direct and FleetWise Edge modes) + * Task definitions: `sim-worker` (Fargate, MQTT Direct), `fwe-agent` (EC2, FleetWise agent), `fwe-simulator` (EC2, Python simulator)