AWS transform documentation change
Summary
Updated network migration documentation with detailed architecture for Transit Gateway model, including appliance VPCs (Inspection, Inbound, Outbound), route tables, traffic flow, and clarified internet connectivity setup for isolated VPCs. Also updated cross-account migration reference link.
Security assessment
The changes add security documentation by clarifying that internet connectivity is not automatically configured for isolated VPCs and must be manually set up. It also emphasizes that cross-VPC traffic passes through the Inspection VPC without inspection by default, requiring users to deploy a firewall appliance for traffic inspection. However, there is no evidence of a specific security vulnerability being addressed; these are clarifications and architectural details.
Diff
diff --git a/transform/latest/userguide/transform-vmware-migrate-network.md b/transform/latest/userguide/transform-vmware-migrate-network.md index 7686cbafb..f71b24386 100644 --- a//transform/latest/userguide/transform-vmware-migrate-network.md +++ b//transform/latest/userguide/transform-vmware-migrate-network.md @@ -36 +36 @@ To migrate your network, follow these steps: -For multi-account deployments, you must configure cross-account IAM roles and trusted access for AWS Organizations before starting the network migration. For more information, see [Migration to multiple target accounts](./migration-multiple-target-accounts.html). +For multi-account deployments, you must configure cross-account IAM roles and trusted access for AWS Organizations before starting the network migration. For more information, see [Step 1: Migration type selection](./transform-vmware-connect-target-account.html#transform-vmware-cta-migration-type). @@ -91,4 +90,0 @@ During the network definition step, you select a network topology. You can choos -###### Important - -For both topologies, AWS Transform does not open the communication to the internet. You must open it manually after taking appropriate security precautions. - @@ -98,0 +95,4 @@ These are independent network environments that operate as separate units within +###### Important + +No internet connectivity is configured for Isolated VPCs. You must set up internet gateways, NAT gateways, and routing manually. + @@ -101 +101,14 @@ These are independent network environments that operate as separate units within -In this model, an AWS Transit Gateway created by AWS Transform acts as the hub that connects to multiple workload VPCs (the spokes). During network convergence, AWS Transform creates a spoke VPC for each detected source network segment. +In this model, an [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html) acts as the central hub that connects multiple workload VPCs (the spokes). AWS Transform creates a spoke VPC for each detected source network segment and connects them through the Transit Gateway. + +**Appliance VPCs** + +AWS Transform creates three specialized appliance VPCs to manage traffic flow and security: + + * **Inspection VPC:** Hosts your firewall appliance for traffic inspection. All cross-VPC traffic is routed through this VPC. You must deploy a firewall (such as [AWS Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/getting-started.html) or a third-party appliance) in this VPC. The Transit Gateway attachment uses [appliance mode](https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-appliance-scenario.html) to ensure symmetric routing. + + * **Inbound VPC:** Handles traffic from the public internet (north-south inbound). Includes an [internet gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html) and public subnets across multiple Availability Zones. + + * **Outbound VPC:** Handles traffic to the public internet (north-south outbound). Includes an internet gateway, [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) with [elastic IP addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html) in each Availability Zone for high availability, and private subnets for the Transit Gateway attachment. + + + @@ -103 +116 @@ In this model, an AWS Transit Gateway created by AWS Transform acts as the hub t -AWS Transform creates three specialized VPCs for traffic management and security: +**Transit Gateway route tables** @@ -105 +118 @@ AWS Transform creates three specialized VPCs for traffic management and security - * Inspection VPC: Where you establish the firewall that inspects the traffic. You can create firewall rule configurations here to modify VPC connections. +AWS Transform creates two Transit Gateway route tables to steer traffic through the Inspection VPC: @@ -107 +120 @@ AWS Transform creates three specialized VPCs for traffic management and security - * Inbound VPC: For all traffic from the public internet (north-south). Includes an internet gateway. + * **Uninspected:** Associated with spoke VPCs, Inbound VPC, and Outbound VPC. Routes all traffic (0.0.0.0/0) to the Inspection VPC attachment. This is the default association route table — new VPC attachments are automatically associated with it. @@ -109 +122 @@ AWS Transform creates three specialized VPCs for traffic management and security - * Outbound VPC: For all traffic to the public internet. Has an internet gateway, a Network Address Translation (NAT) gateway and an [elastic IP address](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html). + * **Inspected:** Associated with the Inspection VPC. Contains propagated routes from all spoke VPCs, so inspected traffic can reach its destination. This is the default propagation route table — spoke VPC routes are automatically propagated to it. @@ -114 +127,24 @@ AWS Transform creates three specialized VPCs for traffic management and security -AWS Transform automatically associates all spoke VPCs with the default association route table and propagates routes from all spoke VPCs to the default propagation route table. This automation creates routing paths without manual configuration, though traffic flow remains subject to security group permissions. +**Traffic flow** + +All cross-VPC traffic follows this path: + + 1. Traffic from a spoke VPC is sent to the Transit Gateway (default route 0.0.0.0/0). + + 2. The Uninspected route table routes the traffic to the Inspection VPC. + + 3. Your firewall in the Inspection VPC inspects the traffic and forwards it back to the Transit Gateway. + + 4. The Inspected route table routes the traffic to the destination spoke VPC using propagated routes. + + + + +For outbound internet traffic, the Inspected route table routes traffic to the Outbound VPC, where NAT gateways translate private IP addresses before forwarding to the internet gateway. The Outbound VPC public route table includes specific routes for each spoke VPC CIDR back to the Transit Gateway, enabling return traffic to reach the correct spoke VPC. Inbound internet traffic enters through the Inbound VPC's internet gateway and follows the same inspection path to reach spoke VPCs. + +For multi-account deployments, AWS Transform shares the Transit Gateway across accounts using [AWS Resource Access Manager (RAM)](https://docs.aws.amazon.com/ram/latest/userguide/what-is.html). + +###### Note + +By default, cross-VPC traffic passes through the Inspection VPC without inspection. To inspect traffic, deploy a firewall appliance (such as [AWS Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/getting-started.html)) in the Inspection VPC. + +To deploy a firewall, create additional subnets in the Inspection VPC for the firewall endpoints. AWS Transform creates subnets for the Transit Gateway attachment only. Route traffic from the TGW attachment subnets to the firewall endpoints, and from the firewall subnets back to the Transit Gateway. For more information, see [Creating a firewall with a Transit Gateway](https://docs.aws.amazon.com/network-firewall/latest/developerguide/create-tgw-firewall.html). @@ -364 +400 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Connect target account +Build landing zone @@ -366 +402 @@ Connect target account -Migration to multiple target accounts +Migrate servers