AWS mgn documentation change
Summary
Added a markdown link reference and a new section about 'Missing Amazon Linux 2023 repository configuration' error with troubleshooting steps
Security assessment
The change adds documentation about a configuration issue where replication servers fail due to missing S3 endpoint policy access to the AL2023 package repository. This is a network security configuration issue (VPC endpoint policies and firewall rules) that impacts service functionality but doesn't address a specific security vulnerability. The documentation helps users properly configure network security controls.
Diff
diff --git a/mgn/latest/ug/common-replication-errors.md b/mgn/latest/ug/common-replication-errors.md index 309fac71b..47eaf6eb5 100644 --- a//mgn/latest/ug/common-replication-errors.md +++ b//mgn/latest/ug/common-replication-errors.md @@ -0,0 +1,2 @@ +[View a markdown version of this page](common-replication-errors.md) + @@ -5 +7 @@ -Agent not seenNot convergingSnapshot failureUnstable networkFailed to connect AWS replication Agent to replication softwareFailed to establish communication with replication softwareFailed to create firewall rulesFailed to authenticate with serviceFailed to create staging disksFailed to pair the replication agent with replication serverStalled replication when replicating a source volume smaller than 1MiBUnknown data replication error +Agent not seenNot convergingSnapshot failureUnstable networkFailed to connect AWS replication Agent to replication softwareFailed to establish communication with replication softwareFailed to create firewall rulesFailed to authenticate with serviceFailed to create staging disksFailed to pair the replication agent with replication serverStalled replication when replicating a source volume smaller than 1MiBUnknown data replication errorMissing Amazon Linux 2023 repository configuration @@ -38,0 +41,2 @@ This section describes common replication errors, possible explanations, and pot + * Missing Amazon Linux 2023 repository configuration + @@ -159,0 +164,28 @@ Unknown errors (unknown_error) can occur for any number of reasons. There are se +## Missing Amazon Linux 2023 repository configuration + +Replication servers use Amazon Linux 2023 (AL2023) and require access to the AL2023 package repository hosted in Amazon S3. If the staging area subnet does not have outbound internet access and the Amazon S3 VPC gateway endpoint policy does not allow access to the AL2023 repository bucket, replication servers may fail to launch or function correctly. + +Symptoms of this issue include: + + * Replication stalling or failing after the replication server is launched. + + * Replication server unable to install or update required packages. + + + + +To resolve this issue: + + 1. Ensure that the Amazon S3 VPC gateway endpoint policy associated with your staging area subnet allows access to the AL2023 package repository bucket (`al2023-repos-<REGION>-de612dc2`). Add the following resource ARN to the endpoint policy: + + "arn:aws:s3:::al2023-repos-<REGION>-de612dc2/*" + + 2. If you use a firewall or proxy, allowlist the following Amazon S3 URL: + + https://al2023-repos-<REGION>-de612dc2.s3.<REGION>.amazonaws.com/ + + + + +For the complete list of Amazon S3 buckets required by AWS Application Migration Service, including the example Amazon S3 VPC endpoint policy, see [Network requirements](./preparing-environments.html). +