AWS mgn documentation change
Summary
Major restructuring of network connectivity documentation. Added 'Troubleshooting connectivity issues' section, reorganized connectivity settings, consolidated endpoint and firewall allowlist information, moved and updated firewall configuration instructions, and clarified encryption details.
Security assessment
The changes reorganize and clarify network requirements but do not indicate a response to a specific security vulnerability or incident. The update adds security documentation by explicitly stating 'All communication is encrypted with TLS,' providing details on TLS 1.2 usage for data transfer, and reinforcing the warning against SSL interception for communication between replication servers/source servers and the API endpoint. These are general security best practices and clarifications, not fixes for a disclosed issue.
Diff
diff --git a/mgn/latest/ug/preparing-environments.md b/mgn/latest/ug/preparing-environments.md index f9017538b..9d3c5bcc5 100644 --- a//mgn/latest/ug/preparing-environments.md +++ b//mgn/latest/ug/preparing-environments.md @@ -7 +7 @@ -Service and network architecture overviewNetwork setting preparationsRequired connectivity settings +Service and network architecture overviewNetwork setting preparationsRequired connectivity settingsTroubleshooting connectivity issues @@ -22,0 +23,2 @@ Before you use Application Migration Service, make sure to prepare your environm + * Troubleshooting connectivity issues + @@ -42,2 +43,0 @@ As part of network setting preparations, set up a staging area and operational s - * Staging area subnet network requirements - @@ -64,17 +63,0 @@ When planning to migrate to an AWS Local Zone, we recommend setting the staging -### Staging area subnet network requirements - - * The replication servers launched by Application Migration Service in your staging area subnet need to be able to send data over TCP port 443 to either the - - * IPv4 compatible Application Migration Service API endpoint at `https://mgn.`aws-region`.amazonaws.com/`. Replace `aws-region` with the AWS Region code you are replicating to, for example “us-east-1” - - * Dual-stack compatible Application Migration Service API endpoint at `https://mgn.`aws-region`.api.aws`. Replace `aws-region` with the AWS Region code you are replicating to, for example “us-east-1” - - * The source servers on which the AWS Replication Agent is installed need be able to send data over TCP port 1500 to the replication servers in the staging area subnet. They also need to be able to send data to the Application Migration Service API endpoint at `https://mgn.{region}.amazonaws.com/`. Replace “{region}” with the AWS Region code you are replicating to, for example “us-east-1” . - - - - -###### Note - -SSL interception should not be applied for communication between replication servers and the Application Migration Service API endpoint, as well as between source servers and the MGN; API endpoint. - @@ -91 +74 @@ Test and cutover instances are launched in a subnet you specify in the Amazon EC -To prepare your network for running AWS Application Migration Service, set these connectivity settings: +To prepare your network for running AWS Application Migration Service, configure the following connectivity settings. All communication is encrypted with TLS. @@ -93 +76 @@ To prepare your network for running AWS Application Migration Service, set these -###### Note +###### Important @@ -95 +78 @@ To prepare your network for running AWS Application Migration Service, set these -All communication is encrypted with TLS. +SSL interception should not be applied for communication between replication servers and the Application Migration Service API endpoint, or between source servers and the Application Migration Service API endpoint. @@ -99,8 +82 @@ All communication is encrypted with TLS. - * Communication over TCP port 443 - - * Communication between the source servers and AWS Application Migration Service over TCP port 443 - - * Communication between the staging area subnet and AWS Application Migration Service over TCP port 443 - - * Communication between the source servers and the staging area subnet over TCP port 1500 - + * Endpoints and firewall allowlist @@ -107,0 +84 @@ All communication is encrypted with TLS. + * Communication between source servers and AWS Application Migration Service over TCP port 443 @@ -108,0 +86 @@ All communication is encrypted with TLS. + * Communication between source servers and the staging area subnet over TCP port 1500 @@ -110 +88 @@ All communication is encrypted with TLS. -### Communication over TCP port 443 + * Communication between the staging area subnet and AWS Application Migration Service over TCP port 443 @@ -112 +89,0 @@ All communication is encrypted with TLS. -Add these IP addresses and URLs to your firewall: @@ -114 +90,0 @@ Add these IP addresses and URLs to your firewall: -The AWS Application Migration Service AWS Region-specific console address: @@ -116 +91,0 @@ The AWS Application Migration Service AWS Region-specific console address: - * (mgn.<region>.amazonaws.com _example: mgn.eu-west-1.amazonaws.com_) @@ -117,0 +93 @@ The AWS Application Migration Service AWS Region-specific console address: +### Endpoints and firewall allowlist @@ -118,0 +95 @@ The AWS Application Migration Service AWS Region-specific console address: +Add the following endpoints and URLs to your firewall allowlist. @@ -119,0 +97 @@ The AWS Application Migration Service AWS Region-specific console address: +**Application Migration Service API endpoints** @@ -121 +99,4 @@ The AWS Application Migration Service AWS Region-specific console address: -Amazon S3 service URLs (required for downloading AWS Application Migration Service software) +Protocol | Endpoint +---|--- +IPv4 | `https://mgn.`region`.amazonaws.com` +Dual-stack (IPv4/IPv6) | `https://mgn.`region`.api.aws` @@ -123 +104 @@ Amazon S3 service URLs (required for downloading AWS Application Migration Servi - * The AWS Replication Agent installer should have access to the Amazon S3 bucket URL of the AWS Region you are using with AWS Application Migration Service. +Replace `region` with the AWS Region code you are replicating to (for example, `us-east-1`). @@ -125 +106 @@ Amazon S3 service URLs (required for downloading AWS Application Migration Servi - * The staging area subnet should have access to Amazon S3. +**Amazon EC2 endpoint** @@ -127 +108 @@ Amazon S3 service URLs (required for downloading AWS Application Migration Servi - * Allowlist these Amazon S3 buckets: +The staging area subnet requires outbound access to the [Amazon EC2 endpoint of its AWS Region](https://docs.aws.amazon.com/general/latest/gr/rande.html). @@ -129,8 +110 @@ Amazon S3 service URLs (required for downloading AWS Application Migration Servi - https://aws-mgn-clients-<REGION>.s3.<REGION>.amazonaws.com/ - https://aws-mgn-clients-hashes-<REGION>.s3.<REGION>.amazonaws.com/ - https://aws-mgn-internal-<REGION>.s3.<REGION>.amazonaws.com/ - https://aws-mgn-internal-hashes-<REGION>.s3.<REGION>.amazonaws.com/ - https://aws-application-migration-service-<REGION>.s3.<REGION>.amazonaws.com/ - https://aws-application-migration-service-hashes-<REGION>.s3.<REGION>.amazonaws.com/ - https://amazon-ssm-<REGION>.s3.<REGION>.amazonaws.com/ - https://al2023-repos-<REGION>-de612dc2.s3.<REGION>.amazonaws.com/ +**Amazon S3 buckets** @@ -137,0 +112 @@ Amazon S3 service URLs (required for downloading AWS Application Migration Servi +The AWS Replication Agent installer and the staging area subnet require access to Amazon S3. Allowlist these buckets: @@ -139,0 +115,8 @@ Amazon S3 service URLs (required for downloading AWS Application Migration Servi + https://aws-mgn-clients-<region>.s3.<region>.amazonaws.com/ + https://aws-mgn-clients-hashes-<region>.s3.<region>.amazonaws.com/ + https://aws-mgn-internal-<region>.s3.<region>.amazonaws.com/ + https://aws-mgn-internal-hashes-<region>.s3.<region>.amazonaws.com/ + https://aws-application-migration-service-<region>.s3.<region>.amazonaws.com/ + https://aws-application-migration-service-hashes-<region>.s3.<region>.amazonaws.com/ + https://amazon-ssm-<region>.s3.<region>.amazonaws.com/ + https://al2023-repos-<region>-de612dc2.s3.<region>.amazonaws.com/ @@ -144,3 +127 @@ Amazon S3 service URLs (required for downloading AWS Application Migration Servi -Learn more about S3 dual-stack endpoints in [Amazon S3 dual-stack endpoints](https://docs.aws.amazon.com/AmazonS3/latest/API/dual-stack-endpoints.html#dual-stack-endpoints-description). - -Agent installation and replication server components require Amazon S3 bucket for service functionality. +For IPv6/dual-stack environments, use the Amazon S3 dual-stack endpoint format: `https://<bucket>.s3.dualstack.<region>.amazonaws.com/`. Learn more about [Amazon S3 dual-stack endpoints](https://docs.aws.amazon.com/AmazonS3/latest/API/dual-stack-endpoints.html#dual-stack-endpoints-description). @@ -150 +131,3 @@ Agent installation and replication server components require Amazon S3 bucket fo -If your staging area subnet does not have outbound internet access, ensure that your Amazon S3 VPC gateway endpoint policy allows access to the Amazon Linux 2023 package repository bucket (`al2023-repos-<REGION>-de612dc2`). +If your staging area subnet does not have outbound internet access, ensure that your Amazon S3 VPC gateway endpoint policy allows access to the Amazon Linux 2023 package repository bucket (`al2023-repos-<region>-de612dc2`). + +**Amazon S3 VPC Endpoint policy** @@ -188,5 +171 @@ JSON -**AWS specific** - -The staging area subnet requires outbound access to the [Amazon EC2 endpoint of its AWS Region.](https://docs.aws.amazon.com/general/latest/gr/rande.html) - -TCP port 443 is used for two communication routes: +### Communication between source servers and AWS Application Migration Service over TCP port 443 @@ -194 +173 @@ TCP port 443 is used for two communication routes: -1\. Between the source servers and AWS Application Migration Service. +Each source server that is added to Application Migration Service must continuously communicate with the Application Migration Service API endpoint over TCP port 443. @@ -196 +175 @@ TCP port 443 is used for two communication routes: -2\. Between the staging area subnet and AWS Application Migration Service. +The main operations performed through this route are: @@ -198,9 +177 @@ TCP port 443 is used for two communication routes: -### Communication between the source servers and AWS Application Migration Service over TCP port 443 - -Each source server that is added to Application Migration Service must continuously communicate with Application Migration Service (mgn.<region>.amazonaws.com) over TCP port 443. - -These are the main operations performed through TCP port 443: - - * Downloading the AWS Replication Agent on the source servers. - - * Upgrading installed agents. + * Downloading and upgrading the AWS Replication Agent. @@ -210 +181 @@ These are the main operations performed through TCP port 443: - * Monitoring the source servers for internal troubleshooting and the use of resource consumption metrics (such as CPU, RAM). + * Monitoring the source servers for troubleshooting and resource consumption metrics (CPU, RAM). @@ -212 +183 @@ These are the main operations performed through TCP port 443: - * Reporting source server-related events (for example, a removal of disk, or resizing of a disk). + * Reporting source server-related events (for example, disk changes). @@ -214 +185 @@ These are the main operations performed through TCP port 443: - * Transmit source server-related information to the Application Migration Service console (including hardware information, running services, and installed applications and packages). + * Transmitting source server information to the Application Migration Service console (hardware information, running services, installed applications and packages). @@ -221,33 +192 @@ These are the main operations performed through TCP port 443: -###### Important - -Make sure that your corporate firewall allows connections over TCP port 443. - -#### Solving communication problems over TCP port 443 between the source servers and AWS Application Migration Service - -If there is no connection between your source servers and Application Migration Service, make sure that your corporate firewall enables connectivity from the source servers to Application Migration Service over TCP Port 443. If the connectivity is blocked, enable it. - -##### Enabling Windows Firewall for TCP port 443 connectivity - -###### Important - -The information provided in this section is for general security and firewall guidance only. The information is provided on "AS IS" basis, with no guarantee of completeness, accuracy or timeliness, and without warranty or representations of any kind, expressed or implied. In no event will AWS and/or its subsidiaries and/or their employees or service providers be liable to you or anyone else for any decision made or action taken in reliance on the information provided here or for any direct, indirect, consequential, special or similar damages (including any kind of loss), even if advised of the possibility of such damages. AWS is not responsible for the update, validation, or support of security and firewall information. - -###### Note - -Enabling Windows Firewall for TCP port 443 connectivity allows your servers to achieve outbound connectivity. You may still need to adjust other external components, such as firewall blocking or incorrect routes, in order to achieve full connectivity. - -###### Note - -These instructions are intended for the default OS firewall. Consult the documentation of any third-party local firewall you use to learn how to enable TCP port 443 connectivity. - - 1. On the source server, open the **Windows Firewall** console. - - 2. On the console, select the **Outbound Rules** option from the tree. - - - - 3. On the **Outbound Rules** table, select the rule that relates to the connectivity to Remote Port - 443. Check if the **Enabled** status is **Yes**. - - - - 4. If the Enabled status of the rule is **No** , right-click it and select **Enable Rule** from the pop-up menu. +### Communication between source servers and the staging area subnet over TCP port 1500 @@ -255 +194 @@ These instructions are intended for the default OS firewall. Consult the documen - +Each source server with an installed AWS Replication Agent continuously communicates with the replication servers in the staging area subnet over TCP port 1500. This port is used for the transfer of replicated data from the source servers to the staging area subnet. @@ -256,0 +196 @@ These instructions are intended for the default OS firewall. Consult the documen +The replicated data is encrypted and compressed when transferred over TCP port 1500. The data is encrypted on the source infrastructure before transfer and decrypted at the staging area subnet before being written to the volumes. @@ -257,0 +198 @@ These instructions are intended for the default OS firewall. Consult the documen +AWS Application Migration Service uses TLS 1.2 end to end from the agent installed on the source server to the Replication Server. Each replication server gets assigned a specific TLS server certificate, which is distributed to the corresponding Agent and validated on the agent side. @@ -258,0 +200 @@ These instructions are intended for the default OS firewall. Consult the documen +### Communication between the staging area subnet and AWS Application Migration Service over TCP port 443 @@ -260 +202 @@ These instructions are intended for the default OS firewall. Consult the documen -##### Enabling Linux Firewall for TCP port 443 connectivity +The replication servers in the staging area subnet must continuously communicate with Application Migration Service over TCP port 443. The main operations performed through this route are: @@ -262 +204 @@ These instructions are intended for the default OS firewall. Consult the documen - 1. Enter this command to add the required Firewall rule: + * Downloading the replication software. @@ -264 +206 @@ These instructions are intended for the default OS firewall. Consult the documen -_sudo iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT_