AWS transform documentation change
Summary
Restructured and expanded documentation for Isolated VPCs and Hub and Spoke network topologies. Added detailed setup steps for internet access and inter-VPC connectivity in Isolated VPCs, and firewall deployment and inbound service setup in Hub and Spoke.
Security assessment
The changes enhance documentation of security features like firewall deployment, security group configuration, and network isolation, but provide no evidence of addressing a specific vulnerability. They primarily improve clarity on security best practices.
Diff
diff --git a/transform/latest/userguide/transform-vmware-migrate-network.md b/transform/latest/userguide/transform-vmware-migrate-network.md index ed66c6b8d..03144d435 100644 --- a//transform/latest/userguide/transform-vmware-migrate-network.md +++ b//transform/latest/userguide/transform-vmware-migrate-network.md @@ -93 +93 @@ During the network definition step, you select a network topology. You can choos -Isolated VPCs are independent network environments that operate as separate units within AWS. Your VPCs are completely isolated, with no built-in communication pathways between them. This separation provides the highest level of network boundary protection. You can connect the VPCs through specific networking configurations if needed. +#### What is deployed @@ -95 +95 @@ Isolated VPCs are independent network environments that operate as separate unit -###### Important +Isolated VPCs are independent network environments that operate as separate units within AWS. Your VPCs are completely isolated, with no built-in communication pathways between them. This separation provides the highest level of network boundary protection. @@ -97 +97 @@ Isolated VPCs are independent network environments that operate as separate unit -Isolated VPCs don't include internet connectivity. You must set up internet gateways, NAT gateways, and routing manually. +AWS Transform creates the following resources: @@ -99 +99 @@ Isolated VPCs don't include internet connectivity. You must set up internet gate -### Hub and Spoke + * A dedicated VPC for each detected source network segment. @@ -101 +101 @@ Isolated VPCs don't include internet connectivity. You must set up internet gate -In this model, an [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html) acts as the central hub that connects multiple workload VPCs (the spokes). A spoke VPC is created for each detected source network segment and connected through the Transit Gateway. + * Private subnets based on your source network configuration. @@ -103 +103 @@ In this model, an [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/t -#### Appliance VPCs + * Security groups (if you provided firewall or SDN configuration files). @@ -105 +104,0 @@ In this model, an [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/t -AWS Transform creates three specialized appliance VPCs to manage traffic flow and security: @@ -107 +105,0 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an - * **Inspection VPC:** Hosts your firewall appliance for traffic inspection. All cross-VPC traffic is routed through this VPC. You must deploy a firewall (such as [AWS Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/getting-started.html) or a third-party appliance) in this VPC. The Transit Gateway attachment uses [appliance mode](https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-appliance-scenario.html), a setting that ensures traffic flows symmetrically through the same appliance for both directions of a connection. @@ -109 +106,0 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an - * **Inbound VPC:** Handles traffic entering your network from the public internet (north-south inbound). Includes an [internet gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html) and public subnets across multiple Availability Zones. @@ -111 +108,3 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an - * **Outbound VPC:** Handles traffic leaving your network to the public internet (north-south outbound). Includes an internet gateway, [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) with [elastic IP addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html) in each Availability Zone for high availability, and private subnets for the Transit Gateway attachment. +#### Complete your setup + +AWS Transform deploys the network infrastructure but leaves internet access and inter-VPC connectivity to you, so you can choose the configuration that meets your organization's requirements. @@ -112,0 +112 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an +To enable internet access for an Isolated VPC, complete the following steps: @@ -113,0 +114 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an + 1. Create an [internet gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html) and attach it to the VPC. @@ -114,0 +116 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an + 2. Create public subnets in each Availability Zone where you need internet access. Add a route for `0.0.0.0/0` pointing to the internet gateway. For more information about subnet configuration, see [Subnets for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html). @@ -116 +118 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an -#### Transit Gateway route tables + 3. Create [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) in the public subnets (one per AZ for high availability). Allocate an Elastic IP for each NAT gateway. @@ -118 +120 @@ AWS Transform creates three specialized appliance VPCs to manage traffic flow an -AWS Transform creates two Transit Gateway route tables to steer traffic through the Inspection VPC: + 4. Update your private subnet [route tables](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html) — add a route for `0.0.0.0/0` pointing to the NAT gateway in the same AZ. @@ -120 +122 @@ AWS Transform creates two Transit Gateway route tables to steer traffic through - * **Uninspected:** Associated with spoke VPCs, Inbound VPC, and Outbound VPC. Routes all traffic (0.0.0.0/0) to the Inspection VPC attachment. This is the default association route table — new VPC attachments are automatically associated with it. + 5. Review your [security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html) — ensure outbound rules allow the traffic your workloads need (HTTPS, DNS, etc.). @@ -122 +123,0 @@ AWS Transform creates two Transit Gateway route tables to steer traffic through - * **Inspected:** Associated with the Inspection VPC. Contains propagated routes from all spoke VPCs, so inspected traffic can reach its destination. This is the default propagation route table — spoke VPC routes are automatically propagated to it. @@ -125,0 +127,24 @@ AWS Transform creates two Transit Gateway route tables to steer traffic through +For VPC-to-VPC communication, set up [VPC peering](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) or a [Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html) and update route tables in each VPC to route traffic to the peering connection or TGW attachment. + +### Hub and Spoke + +In this model, an [AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html) acts as the central hub that connects multiple workload VPCs (the spokes). + +#### What is deployed + +AWS Transform creates the following resources: + + * **Spoke VPCs:** One VPC per detected source network segment, with private subnets and a Transit Gateway attachment. + + * **Inspection VPC:** Hosts your firewall appliance for traffic inspection. All cross-VPC traffic is routed through this VPC. The Transit Gateway attachment uses [appliance mode](https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-appliance-scenario.html), a setting that ensures traffic flows symmetrically through the same appliance for both directions of a connection. + + * **Inbound VPC:** Handles traffic entering your network from the public internet (north-south inbound). Includes an [internet gateway](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html) and public subnets across multiple Availability Zones. + + * **Outbound VPC:** Handles traffic leaving your network to the public internet (north-south outbound). Includes an internet gateway, [NAT gateways](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html) with [elastic IP addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html) in each Availability Zone for high availability, and private subnets for the Transit Gateway attachment. + + * **Transit Gateway route tables:** Two route tables steer traffic through the Inspection VPC. The _Uninspected_ table is associated with spoke VPCs, Inbound VPC, and Outbound VPC — it routes all traffic (0.0.0.0/0) to the Inspection VPC attachment and is the default association route table. The _Inspected_ table is associated with the Inspection VPC — it contains propagated routes from all spoke VPCs and is the default propagation route table. + + + + +For multi-account deployments, the Transit Gateway is shared across accounts through [AWS Resource Access Manager (RAM)](https://docs.aws.amazon.com/ram/latest/userguide/what-is.html). @@ -146 +171,3 @@ Inbound internet traffic enters through the Inbound VPC's internet gateway and f -For multi-account deployments, the Transit Gateway is shared across accounts through [AWS Resource Access Manager (RAM)](https://docs.aws.amazon.com/ram/latest/userguide/what-is.html). +#### Complete your setup + +AWS Transform deploys the network infrastructure but leaves firewall configuration and inbound service setup to you, so you can choose the security appliances and policies that meet your organization's requirements. @@ -150 +177,5 @@ For multi-account deployments, the Transit Gateway is shared across accounts thr -By default, cross-VPC traffic passes through the Inspection VPC without inspection. To inspect traffic, deploy a firewall appliance (such as AWS Network Firewall) in the Inspection VPC. +By default, cross-VPC traffic passes through the Inspection VPC without inspection. You must deploy a firewall to enable traffic inspection. + +**Deploy a firewall:** Create additional subnets in the Inspection VPC for the firewall endpoints. AWS Transform creates subnets for the Transit Gateway attachment only. Route traffic from the TGW attachment subnets to the firewall endpoints, and from the firewall subnets back to the Transit Gateway. You can deploy [AWS Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/getting-started.html) or a third-party appliance. For more information about deploying a firewall with a Transit Gateway, see [Creating a firewall with a Transit Gateway](https://docs.aws.amazon.com/network-firewall/latest/developerguide/create-tgw-firewall.html). + +**Verify connectivity:** After you deploy the firewall, test outbound internet access from a spoke VPC instance (for example, `curl https://aws.amazon.com`). You can use [Reachability Analyzer](https://docs.aws.amazon.com/vpc/latest/reachability/what-is-reachability-analyzer.html) to troubleshoot connectivity issues. @@ -152 +183 @@ By default, cross-VPC traffic passes through the Inspection VPC without inspecti -To deploy a firewall, create additional subnets in the Inspection VPC for the firewall endpoints. AWS Transform creates subnets for the Transit Gateway attachment only. Route traffic from the TGW attachment subnets to the firewall endpoints, and from the firewall subnets back to the Transit Gateway. For more information about deploying a firewall with a Transit Gateway, see [Creating a firewall with a Transit Gateway](https://docs.aws.amazon.com/network-firewall/latest/developerguide/create-tgw-firewall.html). +**Set up inbound services:** To host public-facing services, deploy an [Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html) or [Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) in the Inbound VPC public subnets. Configure target groups that point to instances in your spoke VPCs through the Transit Gateway, and verify that the Inspected route table has return routes to the Inbound VPC.