AWS transform high security documentation change
Summary
Comprehensive update to VMware network migration documentation including rebranded titles, expanded network optimization instructions, enhanced security group mapping details, RVTools security warning, and refined deployment/deletion processes.
Security assessment
Added explicit security warning advising users to download RVTools only from official Dell sources to avoid malware risks from scam sites. Also expanded security documentation through guided recommendations that flag unrestricted inbound rules (0.0.0.0/0) and enhanced security group mapping strategies.
Diff
diff --git a/transform/latest/userguide/transform-vmware-migrate-network.md b/transform/latest/userguide/transform-vmware-migrate-network.md index bf3d7a888..ed66c6b8d 100644 --- a//transform/latest/userguide/transform-vmware-migrate-network.md +++ b//transform/latest/userguide/transform-vmware-migrate-network.md @@ -7 +7 @@ -Step 1: Source network mappingStep 2: Additional configuration filesStep 3: Network topologiesStep 4: Security groups mappingStep 5: Review VPC configurationsStep 6: Network diagramStep 7: Configure resource taggingStep 8: Deploy networkNetwork deletionConfiguration file extraction +Step 1: Source network mappingStep 2: Additional configuration filesStep 3: Network topologiesStep 4: Security groups mappingStep 5: Review and optimize your networkStep 6: Network diagramStep 7: Configure resource taggingStep 8: Deploy your networkDelete deployed network resourcesConfiguration file extraction @@ -9 +9 @@ Step 1: Source network mappingStep 2: Additional configuration filesStep 3: Netw -# Migrate network +# Migrate your network to AWS @@ -11 +11 @@ Step 1: Source network mappingStep 2: Additional configuration filesStep 3: Netw -AWS Transform migrates VMware networks to AWS by translating your source environment configuration into AWS-equivalent network resources. AWS Transform analyzes your source network data and creates VPCs, subnets, security groups, NAT gateways, transit gateways, elastic IPs, routes, and route tables as needed. You can review and modify the generated network configuration before deployment. For deployment, you can either have AWS Transform deploy the configuration for you and analyze deployed network connectivity, or choose self-deployment—in which case AWS Transform generates Infrastructure as Code (IaC) in your preferred format: AWS Cloud Development Kit (AWS CDK) (AWS CDK), Landing Zone Accelerator (LZA), or HashiCorp Terraform. +With AWS Transform, you can migrate your network to AWS. AWS Transform translates your source environment configuration into AWS-equivalent network resources — VPCs, subnets, security groups, NAT gateways, transit gateways, elastic IPs, routes, and route tables as needed. You can review and modify the generated network configuration before deployment. You can deploy the configuration with AWS Transform and analyze network connectivity. Alternatively, you can choose self-deployment and receive Infrastructure as Code (IaC) in your preferred format: AWS Cloud Development Kit (AWS CDK), Landing Zone Accelerator (LZA), or HashiCorp Terraform. @@ -15 +15 @@ To migrate your network, follow these steps: - 1. Upload your source network file + 1. Upload your source network file. @@ -17 +17 @@ To migrate your network, follow these steps: - 2. Upload additional configuration files (optional, for RVTools environments) + 2. Upload additional configuration files (optional, for RVTools environments). @@ -19 +19 @@ To migrate your network, follow these steps: - 3. Select a network topology + 3. Select a network topology. @@ -21 +21 @@ To migrate your network, follow these steps: - 4. Select a security groups mapping strategy + 4. Select a security groups mapping strategy. @@ -23 +23 @@ To migrate your network, follow these steps: - 5. Review the generated VPC configurations + 5. Review and optimize your network. @@ -25 +25 @@ To migrate your network, follow these steps: - 6. Generate a network diagram (optional) + 6. Generate a network diagram (optional). @@ -27 +27 @@ To migrate your network, follow these steps: - 7. Configure resource tagging + 7. Configure resource tagging. @@ -29 +29 @@ To migrate your network, follow these steps: - 8. Deploy your network + 8. Deploy your network. @@ -36 +36 @@ To migrate your network, follow these steps: -For multi-account deployments, you must configure cross-account IAM roles and trusted access for AWS Organizations before starting the network migration. For more information, see [Step 1: Migration type selection](./transform-vmware-connect-target-account.html#transform-vmware-cta-migration-type). +For multi-account deployments, you must configure cross-account IAM roles and trusted access for AWS Organizations before you start the network migration. For more information about migration types, see [Step 1: Migration type selection](./transform-vmware-connect-target-account.html#transform-vmware-cta-migration-type). @@ -40 +40 @@ For multi-account deployments, you must configure cross-account IAM roles and tr -The network mapping process requires uploading a configuration file from your source environment. The tool you choose depends on your source network type: +The network mapping process requires that you upload a configuration file from your source environment. The tool you choose depends on your source network type: @@ -44 +44 @@ The network mapping process requires uploading a configuration file from your so - * **VMware vSphere networks:** [RVTools](https://www.dell.com/en-us/shop/vmware/sl/rvtools). When using RVTools files, AWS Transform generates Amazon VPC configurations only. Security group configurations require additional input from firewall or software-defined network files. See Additional configuration files for more details. + * **VMware vSphere networks:** [RVTools](https://www.dell.com/en-us/shop/vmware/sl/rvtools). When you use RVTools files, AWS Transform generates Amazon VPC configurations only. Security group configurations require additional input from firewall or software-defined network files. For more information about security group generation from additional files, see Additional configuration files. @@ -46 +46 @@ The network mapping process requires uploading a configuration file from your so - * **Networks based on firewall configuration data:** Export files from Palo Alto Networks Firewall, Fortinet FortiGate Firewall, or Cisco ACI. For supported versions and extraction instructions, see Configuration file extraction. + * **Networks based on firewall configuration data:** Export files from Palo Alto Networks Firewall, Fortinet FortiGate Firewall, or Cisco ACI. For more information about supported versions and extraction instructions, see Configuration file extraction. @@ -48 +48 @@ The network mapping process requires uploading a configuration file from your so - * **Hybrid networks running both VMware and non-VMware workloads:** Application mapping tools - modelizeIT. + * **Hybrid networks that run both VMware and non-VMware workloads:** Application mapping tools - modelizeIT. @@ -50 +50 @@ The network mapping process requires uploading a configuration file from your so - * **Other file types:** If your configuration file is not one of the supported formats listed above, AWS Transform will attempt to automatically convert it to a format that can be processed by the service. This conversion can take up to two hours depending on the file size and complexity. + * **Other file types:** If your configuration file is not one of the supported formats listed above, the file is converted automatically to a supported format. This conversion can take up to two hours based on the file size and complexity. @@ -57 +57 @@ The network mapping process requires uploading a configuration file from your so -The official RVTools site is [https://www.dell.com/en-us/shop/vmware/sl/rvtools](https://www.dell.com/en-us/shop/vmware/sl/rvtools), which is the site that this guide links to in steps that mention RVTools. Beware of the scam site (rvtools)(dot)(org). +Download RVTools only from the official Dell site at [https://www.dell.com/en-us/shop/vmware/sl/rvtools](https://www.dell.com/en-us/shop/vmware/sl/rvtools). Do not download RVTools from unofficial sources. @@ -59 +59 @@ The official RVTools site is [https://www.dell.com/en-us/shop/vmware/sl/rvtools] -AWS Transform creates VPCs from all source network segments, with each detected segment becoming its own distinct VPC. Network segmentation varies by source type: +Each source network segment is mapped to its own distinct VPC. Network segmentation varies by source type: @@ -61 +61 @@ AWS Transform creates VPCs from all source network segments, with each detected - * **vNetwork:** AWS Transform groups VMs by vSwitch and VLAN. VLANs can appear under multiple vSwitches (except VLAN 0). + * **vNetwork:** AWS Transform groups VMs by vSwitch and virtual LAN (VLAN). VLANs can appear under multiple vSwitches (except VLAN 0). @@ -70 +70 @@ AWS Transform creates VPCs from all source network segments, with each detected -For RVTools source environments, you can optionally upload additional configuration files to enable security group generation. Without additional configuration, no security groups will be generated for RVTools-based migrations. +For RVTools source environments, you can optionally upload additional configuration files to enable security group generation. If you don't upload additional configuration files, no security groups are generated for your RVTools-based migration. @@ -72 +72 @@ For RVTools source environments, you can optionally upload additional configurat -AWS Transform supports the following additional configuration file types. Only one configuration file from one platform can be uploaded. +AWS Transform supports the following additional configuration file types. You can upload only one configuration file from one platform. @@ -74 +74 @@ AWS Transform supports the following additional configuration file types. Only o - * Cisco Application Centric Infrastructure (ACI): Network policy configurations + * Cisco Application Centric Infrastructure (ACI) provides network policy configurations. @@ -76 +76 @@ AWS Transform supports the following additional configuration file types. Only o - * Palo Alto Networks: Firewall security policies + * Palo Alto Networks provides firewall security policies. @@ -78 +78 @@ AWS Transform supports the following additional configuration file types. Only o - * Fortinet FortiGate: Firewall security policies + * Fortinet FortiGate provides firewall security policies. @@ -85 +85 @@ When you upload a firewall or Cisco ACI file, AWS Transform generates network in -For supported versions and extraction instructions, see Configuration file extraction. +For more information about supported versions and extraction instructions, see Configuration file extraction. @@ -93 +93 @@ During the network definition step, you select a network topology. You can choos -These are independent network environments that operate as separate units within AWS. VPCs maintain complete network isolation, with no built-in communication pathways between them. This separation provides the highest level of network boundary protection. You can connect the VPCs through specific networking configurations if needed. +Isolated VPCs are independent network environments that operate as separate units within AWS. Your VPCs are completely isolated, with no built-in communication pathways between them. This separation provides the highest level of network boundary protection. You can connect the VPCs through specific networking configurations if needed. @@ -97 +97 @@ These are independent network environments that operate as separate units within -No internet connectivity is configured for Isolated VPCs. You must set up internet gateways, NAT gateways, and routing manually. +Isolated VPCs don't include internet connectivity. You must set up internet gateways, NAT gateways, and routing manually. @@ -101 +101 @@ No internet connectivity is configured for Isolated VPCs. You must set up intern -In this model, an [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html) acts as the central hub that connects multiple workload VPCs (the spokes). AWS Transform creates a spoke VPC for each detected source network segment and connects them through the Transit Gateway. +In this model, an [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html) acts as the central hub that connects multiple workload VPCs (the spokes). A spoke VPC is created for each detected source network segment and connected through the Transit Gateway. @@ -103 +103 @@ In this model, an [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/t -**Appliance VPCs** +#### Appliance VPCs @@ -107 +107 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an - * **Inspection VPC:** Hosts your firewall appliance for traffic inspection. All cross-VPC traffic is routed through this VPC. You must deploy a firewall (such as [AWS Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/getting-started.html) or a third-party appliance) in this VPC. The Transit Gateway attachment uses [appliance mode](https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-appliance-scenario.html) to ensure symmetric routing. + * **Inspection VPC:** Hosts your firewall appliance for traffic inspection. All cross-VPC traffic is routed through this VPC. You must deploy a firewall (such as [AWS Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/getting-started.html) or a third-party appliance) in this VPC. The Transit Gateway attachment uses [appliance mode](https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-appliance-scenario.html), a setting that ensures traffic flows symmetrically through the same appliance for both directions of a connection. @@ -109 +109 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an - * **Inbound VPC:** Handles traffic from the public internet (north-south inbound). Includes an [internet gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html) and public subnets across multiple Availability Zones. + * **Inbound VPC:** Handles traffic entering your network from the public internet (north-south inbound). Includes an [internet gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html) and public subnets across multiple Availability Zones. @@ -111 +111 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an - * **Outbound VPC:** Handles traffic to the public internet (north-south outbound). Includes an internet gateway, [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) with [elastic IP addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html) in each Availability Zone for high availability, and private subnets for the Transit Gateway attachment. + * **Outbound VPC:** Handles traffic leaving your network to the public internet (north-south outbound). Includes an internet gateway, [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) with [elastic IP addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html) in each Availability Zone for high availability, and private subnets for the Transit Gateway attachment. @@ -116 +116 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an -**Transit Gateway route tables** +#### Transit Gateway route tables @@ -127 +127 @@ AWS Transform creates two Transit Gateway route tables to steer traffic through -**Traffic flow** +#### Traffic flow @@ -142 +142 @@ All cross-VPC traffic follows this path: -For outbound internet traffic, the Inspected route table routes traffic to the Outbound VPC, where NAT gateways translate private IP addresses before forwarding to the internet gateway. The Outbound VPC public route table includes specific routes for each spoke VPC CIDR back to the Transit Gateway, enabling return traffic to reach the correct spoke VPC. Inbound internet traffic enters through the Inbound VPC's internet gateway and follows the same inspection path to reach spoke VPCs. +For outbound internet traffic, the Inspected route table routes traffic to the Outbound VPC. NAT gateways translate private IP addresses before the traffic is forwarded to the internet gateway. The Outbound VPC public route table includes specific routes for each spoke VPC Classless Inter-Domain Routing (CIDR) range back to the Transit Gateway. These routes enable return traffic to reach the correct spoke VPC. @@ -144 +144,3 @@ For outbound internet traffic, the Inspected route table routes traffic to the O -For multi-account deployments, AWS Transform shares the Transit Gateway across accounts using [AWS Resource Access Manager (RAM)](https://docs.aws.amazon.com/ram/latest/userguide/what-is.html). +Inbound internet traffic enters through the Inbound VPC's internet gateway and follows the same inspection path to reach spoke VPCs. + +For multi-account deployments, the Transit Gateway is shared across accounts through [AWS Resource Access Manager (RAM)](https://docs.aws.amazon.com/ram/latest/userguide/what-is.html). @@ -148 +150 @@ For multi-account deployments, AWS Transform shares the Transit Gateway across a -By default, cross-VPC traffic passes through the Inspection VPC without inspection. To inspect traffic, deploy a firewall appliance (such as [AWS Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/getting-started.html)) in the Inspection VPC. +By default, cross-VPC traffic passes through the Inspection VPC without inspection. To inspect traffic, deploy a firewall appliance (such as AWS Network Firewall) in the Inspection VPC. @@ -150 +152 @@ By default, cross-VPC traffic passes through the Inspection VPC without inspecti -To deploy a firewall, create additional subnets in the Inspection VPC for the firewall endpoints. AWS Transform creates subnets for the Transit Gateway attachment only. Route traffic from the TGW attachment subnets to the firewall endpoints, and from the firewall subnets back to the Transit Gateway. For more information, see [Creating a firewall with a Transit Gateway](https://docs.aws.amazon.com/network-firewall/latest/developerguide/create-tgw-firewall.html). +To deploy a firewall, create additional subnets in the Inspection VPC for the firewall endpoints. AWS Transform creates subnets for the Transit Gateway attachment only. Route traffic from the TGW attachment subnets to the firewall endpoints, and from the firewall subnets back to the Transit Gateway. For more information about deploying a firewall with a Transit Gateway, see [Creating a firewall with a Transit Gateway](https://docs.aws.amazon.com/network-firewall/latest/developerguide/create-tgw-firewall.html). @@ -156 +158 @@ If you want fine-grained control over the communication between the VPCs, choose -AWS Transform creates security groups based on your source environment configurations. AWS Transform converts security policies, security policy rules, gateway policies, and gateway policy rules to security groups. +Choose how your source security policies translate to AWS security groups. AWS Transform creates security groups based on your source environment configurations. Security policies, security policy rules, gateway policies, and gateway policy rules are converted to security groups. @@ -160 +162 @@ AWS Transform creates security groups based on your source environment configura -AWS Transform makes a best effort to create security groups that match your source environment. Review and modify the generated security groups to ensure that they meet your company's needs and security policies. +AWS Transform creates security groups on a best-effort basis to match your source environment. Review and modify the generated security groups to ensure that they meet your company's needs and security policies. @@ -162 +164 @@ AWS Transform makes a best effort to create security groups that match your sour -**Security group referencing** +### Security group referencing @@ -164 +166 @@ AWS Transform makes a best effort to create security groups that match your sour -When generating security groups, AWS Transform uses security group referencing where supported. Security group referencing sets security rules based on another security group ID rather than specific IP address ranges (CIDR blocks). This approach provides more flexible and maintainable security configurations. +When security groups are generated, AWS Transform uses security group referencing where supported. Security group referencing sets security rules based on another security group ID rather than specific IP address ranges (CIDR blocks). This approach provides more flexible and maintainable security configurations. @@ -166 +168 @@ When generating security groups, AWS Transform uses security group referencing w -In AWS, security group rules can only reference other security groups within the same VPC, or in a connected VPC within the same Region, including across accounts. You cannot reference a security group in a non-connected VPC or across Regions. For connected VPCs, only inbound rules support cross-VPC security group references — outbound rules must use CIDR-based rules. How AWS Transform creates security group rules depends on your chosen network topology: +Your security group rules can only reference other security groups within the same VPC, or in a VPC that is connected within the same Region. Cross-account references are also supported. You cannot reference a security group in a non-connected VPC or across Regions. For connected VPCs, only inbound rules support cross-VPC security group references — outbound rules must use CIDR-based rules. How AWS Transform creates security group rules depends on your chosen network topology: @@ -168 +170 @@ In AWS, security group rules can only reference other security groups within the - * **Hub and Spoke:** Transit Gateway provides network connectivity between VPCs. AWS Transform creates security groups using referencing for both within-VPC and cross-VPC/cross-account ingress rules. Cross-VPC/cross-account egress (outbound) rules use CIDR-based rules. + * **Hub and Spoke:** Transit Gateway provides network connectivity between VPCs. AWS Transform uses referencing for both within-VPC and cross-VPC/cross-account ingress rules. Cross-VPC/cross-account egress (outbound) rules use CIDR-based rules. @@ -170 +172 @@ In AWS, security group rules can only reference other security groups within the - * **Isolated VPCs:** There is no network connectivity between VPCs. AWS Transform creates security groups using referencing for within-VPC rules only. All cross-VPC and cross-account rules use CIDR-based rules. + * **Isolated VPCs:** Your VPCs have no network connectivity between them. AWS Transform uses referencing for within-VPC rules only. All cross-VPC and cross-account rules use CIDR-based rules. @@ -181 +183,3 @@ Choose one of the following security group mapping strategies: - * **MAP_DHCP (Translate with DHCP support):** Translates security rules from your source environment with DHCP compatibility. Because DHCP assigns IP addresses dynamically from the subnet's CIDR range, cross-VPC egress rules are widened to match the full destination subnet CIDR. A narrower CIDR would block DHCP-assigned IPs that fall outside that range — review these rules post-migration. Use this option for DHCP support with cross-VPC Transit Gateway communication. Also works with static IPs, but may produce broader rules than MAP. + * **MAP_DHCP (Translate with DHCP support):** Translates security rules from your source environment with DHCP compatibility. DHCP assigns IP addresses dynamically from the subnet's CIDR range. As a result, cross-VPC egress rules are widened to match the full destination subnet CIDR. A narrower CIDR would block DHCP-assigned IPs that fall outside that range — review these rules post-migration. + +Use this option for DHCP support with cross-VPC Transit Gateway communication. Also works with static IPs, but might produce broader rules than MAP. @@ -192 +196 @@ Your mapping strategy determines your IP assignment options. MAP supports static -**IP migration approaches** +### IP migration approaches @@ -194 +198 @@ Your mapping strategy determines your IP assignment options. MAP supports static -The system offers two key network configuration choices for your migration: +You have two network configuration choices for your migration: @@ -196 +200 @@ The system offers two key network configuration choices for your migration: -**Network range selection:** +**Network range selection** @@ -198 +202 @@ The system offers two key network configuration choices for your migration: - * **Keep Existing Ranges (IP Address Ranges Retention):** Keep original IP address ranges during migration. Ideal for lift-and-shift scenarios with legacy applications that have hard-coded IP dependencies or existing firewall rules. + * **Keep Existing Ranges (IP Address Ranges Retention):** Keep original IP address ranges during migration. Ideal for migrations where you move applications to AWS without modification (lift-and-shift), especially with legacy applications that have hard-coded IP dependencies or existing firewall rules. @@ -205 +209 @@ The system offers two key network configuration choices for your migration: -**IP addresses assignment:** +**IP address assignment** @@ -207 +211 @@ The system offers two key network configuration choices for your migration: - * **Fixed IP addresses (Static):** The system assigns static IPs based on the CIDR. This is best for applications requiring predictable network behavior, DNS management, or IP-based access control. IPs persist across instance restarts using Elastic Network Interfaces (ENIs). + * **Fixed IP addresses (Static):** AWS Transform assigns static IPs based on the CIDR. This is best for applications that require predictable network behavior, DNS management, or IP-based access control. IPs persist across instance restarts through Elastic Network Interfaces (ENIs), which are virtual network cards attached to your instances. @@ -209 +213 @@ The system offers two key network configuration choices for your migration: - * **Dynamic IP assignment (AWS DHCP):** Automatically assign IPs from subnet pools at instance launch. Optimal for cloud-native applications and auto-scaling workloads. Reduces operational overhead but requires applications to use DNS or service discovery. + * **Dynamic IP assignment (AWS DHCP):** Automatically assign IPs from subnet pools at instance launch. Optimal for applications that are designed to run in the cloud and auto-scaling workloads. Reduces operational overhead but requires applications to use DNS or service discovery. @@ -218 +222 @@ You can combine either range selection with either IP assignment method. -IP addresses assignment strategy is set at the wave level. You can assign different strategies to specific servers by customizing the wave file. For example, if you chose a static IP address approach for the wave but want to assign a dynamic approach to a specific server, you would use `[RESET_VALUE]` as described in [Editing your configuration](https://docs.aws.amazon.com/mgn/latest/ug/configuration-editing.html) in the _Application Migration Service user guide_. +The IP address assignment strategy is set at the wave level. You can assign different strategies to specific servers by customizing the wave file. For example, if you chose a static IP address approach for the wave but want to assign a dynamic approach to a specific server, you would use `[RESET_VALUE]` as described in [Editing your configuration](https://docs.aws.amazon.com/mgn/latest/ug/configuration-editing.html) in the _Application Migration Service user guide_. @@ -220 +224 @@ IP addresses assignment strategy is set at the wave level. You can assign differ -## Step 5: Review VPC configurations +## Step 5: Review and optimize your network @@ -222 +226 @@ IP addresses assignment strategy is set at the wave level. You can assign differ -After AWS Transform generates Amazon VPC configurations, it displays the generated VPC networks. You can either use the current configuration or modify VPC CIDRs. +After AWS Transform generates your target network configuration, you can review the on-premises network segments converged to AWS infrastructure. Use the visual interface to review your network, and the chat interface to make changes and receive guided recommendations. AWS Transform performs cascading impact analysis and implements the required changes to maintain network consistency and compliance with best practices. You can also ask AWS Transform to analyze your network and suggest optimizations — see Guided recommendations. @@ -224 +228 @@ After AWS Transform generates Amazon VPC configurations, it displays the generat -For single-account deployments, you can edit VPC CIDRs only. For multi-account deployments, you can also edit the target accounts for each VPC network. +### Optimize your network @@ -228 +232,49 @@ For single-account deployments, you can edit VPC CIDRs only. For multi-account d -You cannot modify the prefix length (the value after the "/"). +These operations apply to workload VPCs only. For appliance VPCs in the Hub and Spoke topology (Inspection, Inbound, Outbound), only Change IP address is supported. + +You can't undo Delete, Merge, and Split operations. Review your configuration carefully before you apply these changes. + +The following operations are available for VPCs: + + * **Delete:** Permanently remove a VPC from the configuration. Use this for obsolete network segments that should not migrate to AWS. + + * **Exclude:** Temporarily remove a VPC from the migration for phased migration strategies. Excluded VPCs are not deployed but can be re-included later. + + * **Include:** Add a previously excluded VPC back into the migration. + + * **Merge:** Combine two VPCs into one. The first VPC keeps its identity and absorbs all subnets from the second VPC. Security groups are moved to the merged VPC and their associations are rebuilt accordingly. The first VPC's CIDR expands to the smallest CIDR range that contains both original CIDRs, and routing is updated automatically. The second VPC is removed from the configuration. + +Merge requirements: +