AWS transform documentation change
Summary
Updated tagging documentation for AWS Transform network migration, changing from optional tagging to mandatory tagging configuration with detailed automatic tags for launch/replication and MAP program tags
Security assessment
The changes enhance documentation about resource tagging which supports security best practices like resource tracking, compliance, and access control. However, there's no evidence of addressing a specific security vulnerability or incident. The changes clarify tagging requirements for network resources during migration, which can help with security posture management but isn't directly fixing a security issue.
Diff
diff --git a/transform/latest/userguide/transform-vmware-migrate-network.md b/transform/latest/userguide/transform-vmware-migrate-network.md index b16c7f46c..7686cbafb 100644 --- a//transform/latest/userguide/transform-vmware-migrate-network.md +++ b//transform/latest/userguide/transform-vmware-migrate-network.md @@ -0,0 +1,2 @@ +[View a markdown version of this page](transform-vmware-migrate-network.md) + @@ -5 +7 @@ -Step 1: Source network mappingStep 2: Additional configuration filesStep 3: Network topologiesStep 4: Security group mappingStep 5: Review VPC configurationsStep 6: Network diagramStep 7: Tag your network resources (optional)Step 8: Deploy networkNetwork deletionConfiguration file extraction +Step 1: Source network mappingStep 2: Additional configuration filesStep 3: Network topologiesStep 4: Security group mappingStep 5: Review VPC configurationsStep 6: Network diagramStep 7: Configure resource taggingStep 8: Deploy networkNetwork deletionConfiguration file extraction @@ -25 +27 @@ To migrate your network, follow these steps: - 7. Tag your network resources (optional) + 7. Configure resource tagging @@ -193 +195 @@ After reviewing the generated VPC configurations, you can optionally generate a -## Step 7: Tag your network resources (optional) +## Step 7: Configure resource tagging @@ -195 +197 @@ After reviewing the generated VPC configurations, you can optionally generate a -AWS Transform automatically tags all generated resources with `"CreatedBy": "AWSTransform"` along with definition and execution IDs for tracking purposes. You can also add custom tags to network resources during migration. +AWS Transform tags your network resources for launch and replication, and supports custom tags and AWS Migration Acceleration Program (MAP) tags. @@ -197 +199 @@ AWS Transform automatically tags all generated resources with `"CreatedBy": "AWS -If your migration is part of the **AWS Migration Acceleration Program (MAP 2.0)** , AWS Transform applies a MAP tag to your resources. If you provided your MPE ID earlier in the migration process, the tag is applied automatically. Otherwise, AWS Transform asks whether you have a MAP agreement and prompts you to provide your MPE ID — a 10-character code using uppercase letters and digits (for example, ABCDE12345). The applied tag uses the format: +### Automatic tags for launch and replication @@ -199 +201,20 @@ If your migration is part of the **AWS Migration Acceleration Program (MAP 2.0)* - * **Key:** `map-migrated` **Value:** `mig`MPE_ID`` +AWS Transform automatically tags migrated network resources (VPCs, subnets, security groups, and route tables) with the following tags: + + * **Key:** `CreatedBy` **Value:** `AWSApplicationMigrationService` + + * **Key:** `ATWorkspace` **Value:** ``workspace-id`` + + + + +These tags allow using the VPC and subnet for launching test and cutover instances in AWS. + +###### Note + +Network migration generates network segments without internet connectivity, so migrated VPCs and subnets are not suitable as staging areas for replication by default. + +To also use the VPC and subnet as a staging area (replication), manually add the following tags: + + * **Key:** `CreatedFor` **Value:** `AWSTransform` + + * **Key:** `ATWorkspace` **Value:** ``workspace-id`` @@ -204 +225,5 @@ If your migration is part of the **AWS Migration Acceleration Program (MAP 2.0)* -You can apply custom tags at two levels: +You can also apply these tags to any existing AWS network resource to make it available for replication. + +Find your workspace ID in the AWS Transform web app URL: https://... /workspace/`workspace-id`/job/job-id + +### Custom tags @@ -206 +231 @@ You can apply custom tags at two levels: - * **Job-level tags:** Applied to all resources created during the migration job, including VPCs, subnets, security groups, and route tables. +In addition to the tags applied automatically by AWS Transform, you can add custom tags to organize, track costs, and manage compliance for your migrated network resources. You can apply custom tags at two levels: @@ -208 +233,3 @@ You can apply custom tags at two levels: - * **VPC-level tags:** Applied to specific VPC resources and their associated components. Tags automatically cascade to all VPC resources. + * **Job-level tags:** Apply to all resources created by this job, including all VPCs, subnets, security groups, and route tables. + + * **VPC-level tags:** Apply to a specific VPC and automatically cascade to all its associated resources (subnets, security groups, route tables). @@ -217,3 +244 @@ Maximum 40 tags per request. Each tag requires a key and value. AWS tagging conv -AWS Transform applies these tags during network deployment. - -To use existing AWS network resources not created by AWS Transform, you must tag the resources (including VPCs and subnets) with the following tags: +AWS Transform applies these tags when generating the Infrastructure as Code templates. @@ -221 +246 @@ To use existing AWS network resources not created by AWS Transform, you must tag - * **Key:** `CreatedFor` **Value:** `AWSTransform` +### AWS Migration Acceleration Program @@ -223 +248 @@ To use existing AWS network resources not created by AWS Transform, you must tag - * **Key:** `ATWorkspace` **Value:** ``workspace-id`` +If your migration is part of the **AWS Migration Acceleration Program (MAP 2.0)** , AWS Transform applies a MAP tag to your resources. If you provided your MPE ID earlier in the migration process, the tag is applied automatically. Otherwise, after you finish reviewing the generated VPC configurations, AWS Transform asks whether you have a MAP agreement and prompts you to provide your MPE ID — a 10-character code using uppercase letters and digits (for example, ABCDE12345). The applied tag uses the format: @@ -224,0 +250 @@ To use existing AWS network resources not created by AWS Transform, you must tag + * **Key:** `map-migrated` **Value:** `mig`MPE_ID`` @@ -228 +253,0 @@ To use existing AWS network resources not created by AWS Transform, you must tag -Find your workspace ID in the AWS Transform web app URL: https://... /workspace/`workspace-id`/job/job-id