AWS drs documentation change
Summary
Fixed minor grammatical errors, typos, and punctuation in the DRS best practices guide. Changes include correcting a missing closing parenthesis, changing 'users' to 'user', 'you' to 'your', and 'a Recovery instances' to 'Recovery instances'.
Security assessment
The changes are purely editorial and grammatical. They do not introduce, modify, or remove any security-related content, policies, or configurations. The document already discusses security best practices (like IAM roles and termination protection), but these specific edits do not alter that security guidance.
Diff
diff --git a/drs/latest/userguide/best_practices_drs.md b/drs/latest/userguide/best_practices_drs.md index 6774f5686..e020652a3 100644 --- a//drs/latest/userguide/best_practices_drs.md +++ b//drs/latest/userguide/best_practices_drs.md @@ -38 +38 @@ You can monitor the health of the ongoing replication using the DRS console or p -Due to Amazon EBS limits on the rate at which EBS snapshots can be taken, the maximum number of servers that can be replicated using DRS in a single AWS account is limited to 300. To replicate more than the maximum number of servers, use multiple AWS accounts, or multiple target AWS Regions (you need to set up DRS separately for each account/ Region. +Due to Amazon EBS limits on the rate at which EBS snapshots can be taken, the maximum number of servers that can be replicated using DRS in a single AWS account is limited to 300. To replicate more than the maximum number of servers, use multiple AWS accounts, or multiple target AWS Regions (you need to set up DRS separately for each account/ Region). @@ -52 +52 @@ You should control who can install the AWS Replication Agent in your account. On - 2. Users who install the agents [assumes that role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html) (must be a user of an AWS account, either yours, or another; you configure who the role is for in step 1). This creates temporary IAM credentials for that users which are used for [agent installation](https://docs.aws.amazon.com/drs/latest/userguide/agent-installation.html). These credentials are limited to only the permissions required for agent installation (and further limited by the permission boundaries you defined), yet are associated with the user (for example, so their usage can be tracked using CloudTrail). + 2. Users who install the agents [assumes that role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html) (must be a user of an AWS account, either yours, or another; you configure who the role is for in step 1). This creates temporary IAM credentials for that user which are used for [agent installation](https://docs.aws.amazon.com/drs/latest/userguide/agent-installation.html). These credentials are limited to only the permissions required for agent installation (and further limited by the permission boundaries you defined), yet are associated with the user (for example, so their usage can be tracked using CloudTrail). @@ -61 +61 @@ You should control who can install the AWS Replication Agent in your account. On - 2. **Termination protection for recovery instances:** When you launch recovery instances in case of a real event, you should prevent them from being inadvertently terminated. This should be done after you have performed launch-validation test, and before data re-routing. You can turn on termination protection directly from the [Amazon EC2 console](https://console.aws.amazon.com/ec2/), by selecting the instances, and from the **Actions** menu choosing **Instance settings, change termination protection** , and choosing **Yes, Enable.** You should document this step in you recovery plan. [Learn more about termination protection](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/terminating-instances.html#Using_ChangingDisableAPITermination). + 2. **Termination protection for recovery instances:** When you launch recovery instances in case of a real event, you should prevent them from being inadvertently terminated. This should be done after you have performed launch-validation test, and before data re-routing. You can turn on termination protection directly from the [Amazon EC2 console](https://console.aws.amazon.com/ec2/), by selecting the instances, and from the **Actions** menu choosing **Instance settings, change termination protection** , and choosing **Yes, Enable.** You should document this step in your recovery plan. [Learn more about termination protection](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/terminating-instances.html#Using_ChangingDisableAPITermination). @@ -65 +65 @@ You should control who can install the AWS Replication Agent in your account. On - 4. **Recovery dos and don’ts:** Do not use the **Disconnect from AWS** action in the DRS console for servers for which you launched Recovery instances, even in the case of a real recovery event. Performing a disconnect terminates all replication resources related to these source servers, including your Point-In-Time (PIT) recovery points. You may need these PITs while you are in failover state, for regulatory reasons, or to re-launch a Recovery instances for any reason (for instance if you discover that the PIT from which you launched includes corrupt or malicious data, and you want to relaunch from an earlier PIT). While you use your Recovery instances as your primary, and new data is presumably written to them, these recovery instances are not themselves being replicated, and you are not creating any new PITs for these changes. It is possible to configure the recovery instances as new source servers and [replicate them cross-Region](https://docs.aws.amazon.com/drs/latest/userguide/failback-failover-region-region.html), to have disaster recovery for your recovery site. This carries with it additional costs, as noted in [Performing a cross-Region failback](https://docs.aws.amazon.com/drs/latest/userguide/failback-failover-region-region.html) + 4. **Recovery dos and don’ts:** Do not use the **Disconnect from AWS** action in the DRS console for servers for which you launched Recovery instances, even in the case of a real recovery event. Performing a disconnect terminates all replication resources related to these source servers, including your Point-In-Time (PIT) recovery points. You may need these PITs while you are in failover state, for regulatory reasons, or to re-launch Recovery instances for any reason (for instance if you discover that the PIT from which you launched includes corrupt or malicious data, and you want to relaunch from an earlier PIT). While you use your Recovery instances as your primary, and new data is presumably written to them, these recovery instances are not themselves being replicated, and you are not creating any new PITs for these changes. It is possible to configure the recovery instances as new source servers and [replicate them cross-Region](https://docs.aws.amazon.com/drs/latest/userguide/failback-failover-region-region.html), to have disaster recovery for your recovery site. This carries with it additional costs, as noted in [Performing a cross-Region failback](https://docs.aws.amazon.com/drs/latest/userguide/failback-failover-region-region.html)