AWS evs documentation change
Summary
Added documentation for two new concepts: 'Connector' (enables communication with VMware management appliances using AWS Secrets Manager for credentials) and 'Windows Server License Entitlement for Amazon EVS' (enables pay-as-you-go Windows Server licensing with dependency on connector reachability).
Security assessment
The change adds documentation about using AWS Secrets Manager to store credentials for connector authentication, which is a security best practice. It also documents that connector reachability is required for license entitlements, with an 8-hour grace period before entitlements are dropped. However, there is no evidence this addresses a specific security vulnerability or incident.
Diff
diff --git a/evs/latest/userguide/concepts.md b/evs/latest/userguide/concepts.md index 60403c9fd..14a1930e2 100644 --- a//evs/latest/userguide/concepts.md +++ b//evs/latest/userguide/concepts.md @@ -7 +7 @@ -Amazon EVS environmentAmazon EVS hostService access subnetAmazon EVS VLAN subnetVMware NSXVMware Hybrid Cloud Extension (HCX) +Amazon EVS environmentAmazon EVS hostService access subnetAmazon EVS VLAN subnetVMware NSXConnectorWindows Server License Entitlement for Amazon EVSVMware Hybrid Cloud Extension (HCX) @@ -88,0 +89,31 @@ VMware NSX is a software-defined networking (SDN) platform that enables network +## Connector + +An Amazon EVS connector enables Amazon EVS to communicate with VMware Cloud Foundation management appliances, such as a vCenter Server appliance, in your environment. Each connector maps to a single management appliance, requiring the fully qualified domain name (FQDN) and credentials you store in an AWS Secrets Manager secret to authenticate with the appliance. Amazon EVS periodically performs reachability checks against the appliance through the connector. If the connector loses reachability, features that depend on the connector will be impacted. + + * To create a connector, see [Create an Amazon EVS environment connector](./evs-env-create-connector.html). + + * To update a connector, see [Update an Amazon EVS environment connector](./evs-env-update-connector.html). + + * To delete a connector, see [Delete an Amazon EVS environment connector](./evs-env-delete-connector.html). + + + + +## Windows Server License Entitlement for Amazon EVS + +Windows Server license entitlement for Amazon EVS enables virtual machines (VMs) running in your Amazon EVS environment to utilize AWS-offered Windows Server licenses. Windows Server license entitlements are offered per vCPU per hour with a pay-as-you-go model. + +To use Windows Server License entitlements, you must first create a connector to establish reachability between Amazon EVS and your vCenter Server appliance. The reachability check on the connector must be passing before you can create an entitlement. + +Amazon EVS uses the vCenter connector to monitor VM lifecycle events for entitled VMs. If the connector loses reachability, associated entitlements enter an at risk state. If reachability is not restored within an 8-hour grace period, entitlements are dropped and license usage tracking is stopped from the time the entitlement entered the at risk state. + +After you have created an entitlement, and powered on a VM, Amazon EVS starts monitoring the corresponding VM’s Windows Server license usage. If the VM is shutdown or the configured vCPU are scaled up or down based on demand, you only pay for the licensing for the total vCPU hours used. + +###### Warning + +Supported guest operating systems are Windows Server 2016 and later. + +For instructions, see [Create an Amazon EVS environment connector](./evs-env-create-connector.html) and [Create an Amazon EVS entitlement](./evs-env-create-entitlement.html). + +After creating entitlements, you can configure each Windows Server VM to activate through a VPC Endpoint. For instructions, see [Configure Windows Server Activation](./evs-activate-windows-server.html). +